An improper check of the filename used in a PHP include/require statement allows a local file inclusion in the Mahogany theme. Exploiting this flaw could give an attacker ability to read sensitive files or, if the included file contains PHP code, execute arbitrary code on the server, compromising confidentiality, integrity, and availability.

The vulnerability affects the Mahogany theme from ThemeREX. All releases from the earliest available through version 2.9 are impacted. No specific sub‑versions are listed; the fix applies to any build older than 3.0.

The CVSS base score of 8.1 indicates a high severity. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local file inclusion, the attack vector is likely local or via a trusted user context, though it could be leveraged by an attacker who gains local access or is able to place a malicious file in a directory accessible to the include statement. Given the potential to execute arbitrary PHP code, administrators should treat the flaw as serious.