The Beacon WordPress theme implements a PHP include/require call that accepts an untrusted filename parameter. A user-supplied value can influence the file path that the server resolves, enabling the server to read arbitrary files from the local filesystem. This mechanism constitutes a Local File Inclusion flaw that can expose sensitive content such as configuration files and other data stored on the server. The weakness is classified as ’Improper Control of Filename for Include/Require Statement’ (CWE‑98).

All WordPress sites that have the ThemeREX Beacon theme version 2.24 or earlier are affected. The issue applies to every release of the theme up to and including 2.24, regardless of the WordPress core version. Site administrators should verify the installed theme version and determine whether their site falls within this range.

With a CVSS score of 8.1 the flaw is in the High severity category, indicating that if exploited it can lead to significant compromise of confidentiality. The EPSS value of less than 1% suggests that widespread exploitation has not yet been observed, but the vulnerability remains accessible through crafted HTTP requests that supply a suitable filename parameter to the theme’s PHP scripts. The flaw is not currently listed in the CISA KEV catalog, yet the ability to read arbitrary files remains a serious risk to sites that rely on the Beacon theme.