This vulnerability arises from improper control of the filename used in a PHP include/require statement within the WordPress Eject theme. An attacker can supply a crafted filename that causes the theme to include arbitrary files from the server, potentially exposing sensitive data or allowing further exploitation. The flaw aligns with CWE‑98, indicating a lack of validation for include paths.

All installations of the WordPress Eject theme released by ThemeREX at versions 2.17 and lower are affected. The vulnerability is present from the earliest releases through any version up to and including 2.17, so WordPress sites using this theme without upgrading are at risk.

The CVSS base score of 8.1 categorises the flaw as high severity. Current EPSS data suggests a very low exploitation likelihood (<1 %) and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must be able to trigger the vulnerable include, typically via a crafted web request against the theme code. No explicit payload requirements are detailed in the provided data, so the concept of exploitation is inferred from the type of LFI described.