The vulnerability is an improper control of the filename for include/require statements in PHP, allowing a local file inclusion. An attacker who can manipulate the filename used by the Dixon theme can cause the PHP interpreter to load and execute a file from the local filesystem. This flaw enables remote code execution or privilege escalation within the context of the WordPress installation, compromising confidentiality, integrity, and availability.

WordPress installations using the ThemeREX Dixon theme with versions from the earliest released build through 1.4.2.1 are affected. Any deployment of this theme within a WordPress site is potentially vulnerable until a fixed version is applied.

The CVSS score is 8.1, indicating high severity. The EPSS score is below 1%, so the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, the lack of a public exploit does not reduce the risk; local attackers or attackers who can influence theme data could provide a crafted filename. The attack vector is inferred to be via any functionality that passes user-controlled input to the include/require statement in the theme. Because the vulnerability is local, it requires either code injection through a different vector or exploitation of the theme configuration interface.