ThemeREX EmojiNation contains an improper control over file names in PHP include/require statements (CWE-98), enabling a local file inclusion flaw. An attacker who can influence the file parameter can read arbitrary files on the server or inject PHP code for execution, thereby compromising confidentiality, integrity, and potentially availability of the site.

The vulnerability affects all versions of the EmojiNation WordPress theme up to and including version 1.0.12 by ThemeREX. No newer versions are currently documented as affected.

The evaluation assigns a rating of 8.1, indicating high severity, while the exploitation probability is currently very low. The likely attack vector is a local request to the theme’s PHP file that includes user-supplied input; the attacker does not need remote access and can leverage the site’s own file system, though the exploit still requires authenticated or unauthenticated access to the theme’s files. The combination of high severity and very low exploitation probability suggests that prevention and timely patching remain critical.