The Police Department theme for WordPress allows an attacker to include local files through an unsanitized filename parameter in a PHP include/require call. This flaw, classified as CWE‑98, can enable the execution of arbitrary code or disclosure of sensitive files on the server. The vulnerability is contained within the theme code and does not rely on external network components, but it can be triggered via standard web requests, potentially giving attackers full control over the affected site if they can supply a writable file path that is interpreted as PHP.

ThemeREX "Police Department" theme for WordPress is affected from the earliest released version up through version 2.17. Any site using an impacted version of this theme, regardless of operating system or server configuration, is at risk.

With a CVSS score of 8.1 the flaw is considered high severity. The EPSS score is below 1 %, indicating that, at present, exploit attempts are rare, and the vulnerability has not been observed in the wild to be included in CISA’s Known Exploited Vulnerabilities catalog. The most likely attack vector is a crafted HTTP request that supplies a malicious filename parameter, inferring that the application blindly trusts input when deciding which file to include. Because the flaw can lead to code execution, it represents a significant risk if an attacker can influence the include path.