ThemeREX Legrand theme up to version 2.17 contains an improper control of filename for include/require statements in PHP. The flaw allows an attacker with sufficient access to supply path arguments that are passed directly to include/require, enabling local file inclusion. Local file inclusion can expose sensitive information or, if attacker-controlled files are included, allow arbitrary code execution. The weakness is identified as CWE-98, indicating failure to properly sanitize filename inputs.

WordPress sites using the ThemeREX Legrand theme, versions n/a through 2.17. Site owners should check the active theme version and identify any deployment of the affected theme.

The CVSS base score of 8.1 reflects a high severity impact. The EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been confirmed. Nevertheless, the attack vector requires the ability to influence the filename parameter passed to an include/require operation, which could be achieved through crafted input such as HTTP GET/POST parameters or directory traversal attempts. The potential for remote code execution makes this vulnerability a critical security concern for administrators who have not applied a fix or mitigated the issue.