The vulnerability allows an attacker to control the filename used in a PHP include/require statement, leading to unintended inclusion of local files. This type of flaw can expose sensitive content such as configuration files or, if an attacker can include a file that contains executable code, it can result in remote code execution. The weakness is categorized as CWE‑98, indicating improper handling of user-controlled file paths.

WordPress sites that install the ThemeREX MCKinney's Politics theme version 1.2.8 or earlier are affected. The issue applies to all releases from the earliest available version up to and including 1.2.8, regardless of patch level or additional plugins, because the flaw resides in the theme’s core PHP files.

The CVSS vector scores the attack at 8.1, indicating high severity. The EPSS rating is below 1 %, meaning the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated request that supplies a crafted path to a local file—such as a credential file or a PHP script that can be executed. The vulnerability does not require elevated privileges or prior authentication, and it can be triggered through the public web interface by manipulating the theme’s include logic.