The Tuning theme contains an improper control of filename for include/require statements. An attacker can supply a crafted input that causes the PHP program to include a local file specified by an unvalidated parameter. This allows the attacker to read sensitive files such as configuration files, credentials, or logs. If the attacker can cause a PHP file to be included, the vulnerability may be leveraged for remote code execution by executing PHP code stored on the server.

All WordPress installations that use the ThemeREX Tuning theme version 1.3 or earlier are affected. Any site that has not upgraded past version 1.3 remains vulnerable.

The CVSS score of 8.1 reflects high severity. Despite the low EPSS score (<1 %) and the lack of listing in the KEV catalog, exploitation is theoretically possible through local file path manipulation. The attack vector is a local file inclusion that requires the attacker to send a request to the WordPress site with a malicious file path parameter, which is then included by the theme. Successful exploitation would grant the attacker unauthorized read access to local files and potentially the ability to execute arbitrary PHP code.