This vulnerability arises from improper validation of a filename supplied to an include or require statement in the Miller WordPress theme. The lack of checks allows an attacker to specify arbitrary local file paths, resulting in a local file inclusion flaw. If an attacker can influence the value passed to the include, they may read sensitive files or cause the server to execute malicious PHP code, thereby compromising confidentiality, integrity, and availability of the site. The weakness is classified as CWE-98.

The affected product is the ThemeREX Miller WordPress theme, versions from the earliest available release through version 1.3.3. Any WordPress installation utilizing these theme versions is susceptible.

The CVSS score of 8.1 indicates a high severity, but the EPSS score of < 1% suggests exploitation is currently rare or unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation typically requires an attacker to supply a crafted request that manipulates the filename parameter in the theme’s PHP code. Successful exploitation could occur if the theme’s include calls are reachable via a public-facing page and the attacker can control the query string or post data. Given the nature of the flaw, attacks would likely be delivered remotely through crafted URLs or form submissions that trigger the include with a malicious path.