The vulnerability arises from insufficient validation of the filename used in PHP include/require statements within the Vapester theme for WordPress. This flaw permits an attacker to specify an arbitrary local file path, enabling the theme to read or execute files that should remain protected. The weakness is classified as a CWE‑98 issue, and its CVSS score of 8.1 indicates a high severity with potential confidentiality and integrity compromise, and if the included file is a PHP script it could lead to remote code execution on the host.

WordPress installations that employ the ThemeREX Vapester theme with a version of 1.1.10 or earlier are affected. No newer versions are known to contain this flaw, so any site still running an impacted release remains vulnerable.

The calculated EPSS score is less than one percent, suggesting that the observed exploitation probability is low, and the vulnerability has not yet appeared in the CISA KEV catalog. Nonetheless, based on the description, it is inferred that the attack vector is likely a web request that manipulates a theme parameter to surface a controlled file path; a compromised user or a malicious actor with access to the site’s query strings could exploit the flaw. Given the lack of a network‑wide vector and the limited EPSS, the risk is moderate but still significant enough to warrant prompt remediation.