This vulnerability occurs because the MoneyFlow theme fails to properly control the filename used in PHP include/require statements, allowing an attacker to craft requests that cause the application to include unintended local files. The flaw can lead to disclosure of sensitive configuration files, user credentials, or even execution of arbitrary PHP code if the attacker can influence the path to a file that contains malicious content. The weakness is categorized as CWE‑98, which highlights improper handling of file names in include operations.

The impact applies to the ThemeREX MoneyFlow theme for WordPress, affecting all installations of version 1.0 and earlier. No specific patch versions are listed in the advisory; vendors recommend using a newer release if available.

The CVSS base score of 8.1 indicates a high‑severity flaw; the EPSS score of less than 1% suggests a low likelihood of mass exploitation at present. This issue is not currently listed in the CISA KEV catalog. Because the vulnerability relies on an attacker manipulating request parameters that dictate a file path, the attack vector is inferred to be through the public web interface, typically by submitting a crafted URL that the theme processes without validation.