The Edge Decor theme for WordPress contains an improper handling of filenames in PHP include and require statements, allowing attackers to specify arbitrary local file paths. This flaw can let a malicious user read sensitive files or, if PHP source code or configuration files are included, execute code on the server, leading to data disclosure, tampering, or full system compromise.

Any WordPress installation using the ThemeREX Edge Decor theme version 2.2 or earlier is affected. The issue is limited to the theme’s core files and does not extend to other plugins or the WordPress core itself.

The vulnerability carries a CVSS score of 8.1, indicating high severity, while the EPSS score of less than 1% suggests a relatively low current exploitation likelihood. It is not listed in the CISA KEV catalog. Attackers would need to trigger the vulnerable include logic, likely through crafted URLs or input fields that pass a filename to the theme’s PHP scripts. Once the include succeeds, the attacker may gain the ability to read arbitrary files or execute arbitrary PHP code on the web server.