The flaw allows the attacker to control the filename used in a PHP include/require statement, which can lead to a local file inclusion (LFI) condition. This enables the execution or inspection of arbitrary files on the web server, potentially exposing configuration data, secrets, or user information and allowing further compromise of the site.

ThemeREX S.King WordPress theme version 1.5.3 or earlier is vulnerable. No other versions specified.

The CVSS score of 8.1 places this vulnerability in the high severity range, indicating a significant impact if exploited. The EPSS score is less than 1%, showing a very low but non-zero exploitation probability at the time of analysis. This vulnerability is not currently listed in the CISA KEV catalog. Likely exploitation requires a crafted request to the vulnerable theme’s file include logic, and it can be performed by unauthenticated users who can influence the value sent to the include statement. The attack vector is inferred from the description, as the CVE does not explicitly state the exact method.