The vulnerability arises from improper handling of file names in PHP include/require statements within the Healer WordPress theme. An attacker who can influence the file path could read arbitrary local files, potentially leading to disclosure of sensitive configuration data or enabling remote code execution if the application subsequently processes the injected content.

ThemeREX Healer – Doctor, Clinic & Medical WordPress Theme, versions up to and including 1.0.0.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time. The vulnerability is not yet listed in CISA’s KEV catalog. An attacker could exploit the LFI by constructing a crafted request to the theme’s PHP files, leveraging the uncontrolled filename to read local files. No special prerequisites beyond a vulnerable install of the theme are required.