The vulnerability originates from improper control of filenames used in PHP's include/require statements within the Mandala WordPress theme. A request that supplies a crafted filename can cause the theme to include arbitrary local files, possibly exposing sensitive data or enabling execution of server‑side code. The CVSS score of 8.1 reflects the significance of the potential information disclosure and code execution risks associated with this local file inclusion flaw.

All installations of the ThemeREX Mandala theme from the earliest available release through version 2.8, inclusive, are affected. WordPress sites that have not upgraded the theme beyond 2.8 remain vulnerable.

The flaw can be triggered via user‑supplied parameters processed by the theme and may be accessed through public URLs. The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. If exploited, an attacker could read arbitrary local files from the server or, if a PHP file is included, execute server‑side code. This impact is confined to the web server hosting the WordPress site and does not rely on user authentication.