The vulnerability resides in the ThemeREX Law Office WordPress theme where a filename supplied to PHP's include or require statement is insufficiently sanitized. This flaw allows an attacker to reference arbitrary files on the server, enabling disclosure of sensitive configuration or credential files and, in some cases, execution of code if a remotely controlled file can be included. The weakness is identified as an improper control of filename for include/require, which directly maps to unchecked file inclusion logic.

All installations of the WordPress Law Office theme from the initial release through version 3.3.0 are impacted. In practice this means every site that has not upgraded beyond 3.3.0 and has the Law Office theme active is vulnerable, regardless of other theme or plugin configurations.

The CVSS score of 8.1 indicates this is a high-severity flaw. The EPSS score, while under 1%, reflects a low but nonzero probability of exploitation in the current landscape. The vulnerability is not yet listed in CISA's KEV catalog. Attackers likely leverage the flaw by manipulating the request that triggers the include/require path, potentially using directory traversal sequences to pull local files such as /etc/passwd or application configuration files. No active exploit is reported, but the high impact combined with the low EPSS warrants swift remediation.