This vulnerability arises from an uncontrolled filename passed to PHP include or require statements within the ThemeREX M.Williamson theme. An attacker who can influence the path may read sensitive files on the server or cause the inclusion of a malicious PHP file, which could then be executed as part of the web application, leading to a full compromise of the WordPress site. The weakness is classified as CWE-98 and directly compromises confidentiality, integrity, and availability of the affected system.

All installations of the M.Williamson WordPress theme with versions up to and including 1.2.11 are affected. Users should verify that no legacy version is active on their site and that the theme has not been modified in a way that reintroduces the vulnerable include logic.

The flaw carries a high severity CVSS score of 8.1, but the estimated likelihood of exploitation is very low, as reflected by a minimal exploitation probability. It is not listed among the known exploited vulnerabilities cataloged by CISA. Attackers would need a source that can submit an include path, which may be provided by a front‑end parameter or an exposed configuration option; no publicly available exploitation tools have been documented to date. Consequently, while the impact is severe if triggered, the current threat of widespread exploitation remains limited.