The Vulnerability arises from inadequate control of the filename supplied to PHP include/require statements. An attacker can manipulate the input to include arbitrary local files, potentially exposing sensitive data or executing malicious code on the server. In the PHP context, a successful local file inclusion can lead to arbitrary code execution, especially if the included file contains executable content. The description indicates that PHP Remote File Inclusion can occur, and the typical impact is the ability to run code with the permissions of the web application.

This flaw affects the ThemeREX Legal Stone WordPress theme, from its initial release through version 1.2.11. Any WordPress installation using the affected theme versions is at risk.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on how the flaw is described, the attack vector most likely involves supplying a crafted filename via a URL or form input that is blindly fed into a PHP include. If successful, the attacker could read files or execute code. Given the lack of an official fix in the data, the recommendation is to apply a patch or mitigate the flaw to reduce risk.