Improper control of filenames in a PHP include/require statement in the ThemeREX Peter Mason theme allows an attacker to include local files. This flaw, identified as CWE‑98, can enable direct reading of arbitrary files on the web server and, if the included file contains PHP code, the execution of that code. The vulnerability does not explicitly state additional impacts such as confidentiality, integrity, or availability loss, but the potential to run code locally is inherent in a local file inclusion flaw.

WordPress sites that deploy any version of the Peter Mason theme up to and including 1.4.5 are affected. The issue exists across the entire range of releases from the initial version to 1.4.5, meaning any instance of the theme within this version ceiling is vulnerable unless the theme has been upgraded beyond that bound.

The CVSS v3 score of 8.1 indicates a high severity rating for the vulnerability, while the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation at the time of analysis. The CVE is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw remotely by crafting HTTP requests that manipulate the include path, with the flaw being triggered when the vulnerable endpoint is exposed. Mitigating factors include typical server restrictions such as open_basedir or file permission settings that can limit the reach of local file inclusion attempts.