The improper control of the filename used in PHP include or require statements within the ThemeREX Motorix theme enables a Local File Inclusion vulnerability. This flaw allows an attacker to cause the WordPress installation to read or execute arbitrary files from the server filesystem. Based on the description, it is inferred that sensitive files such as wp-config.php could be accessed, and if the included files contain executable PHP code, remote code execution might follow. The weakness is identified as CWE‑98, a common class for improperly controlled file inclusion.

Any WordPress site that has the ThemeREX Motorix theme version 1.6 or earlier installed is affected. The vulnerability is present in all releases from the earliest version through 1.6, regardless of other plugins or WordPress core updates.

The CVSS score of 8.1 signals high severity. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, through a crafted HTTP request that manipulates parameters within the theme to supply a file path. The description indicates that the application will include the supplied file, so it is inferred that an attacker could read or possibly execute files on the web server, potentially leading to further compromise of the site or underlying system. Organizations should treat this as a high‑risk vulnerability that requires prompt remediation.