An improper control of filenames in PHP include/require statements allows a local file inclusion flaw in the Invetex WordPress theme. This weakness permits an attacker to read files from the server’s local filesystem, potentially exposing sensitive data or configuration files. The flaw is identified by CWE‑98, indicating a lack of proper filename validation before including files.

The vulnerability affects the ThemeREX Invetex theme for WordPress, from the earliest available build through version 2.18. Users running these versions are exposed until they apply an updated theme.

The severity score is 8.1, indicating high severity. Exploitation probability is below 1%, showing a very low likelihood at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. While the description does not specify the exact attack vector, it likely involves manipulating a file path argument to load an arbitrary local file. If exploited, the attacker can read any file accessible to the webserver.