The Windsor WordPress theme contains an improper control of filename for the include/require statement in PHP, permitting local file inclusion for any version up to 2.5.0. An attacker can supply a crafted path that the theme includes, allowing read access to arbitrary files on the web server such as configuration, password, or code files. This leads to information disclosure, credential theft, and can be a stepping stone to more severe attacks. The weakness is classified as CWE-98.

WordPress sites using the ThemeREX Windsor theme, versions n/a through 2.5.0, are affected.

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion via a publicly accessible parameter that feeds into the theme’s include logic; the attacker needs sufficient file system access to read requested files, and the vulnerability appears to be exploitable without additional privilege escalation.