The vulnerability is an improper control of the filename used in a PHP include/require statement within the ThemeREX Run Gran WordPress theme. By providing a crafted path, an attacker can trigger local file inclusion, causing the theme to read and execute arbitrary files from the server’s filesystem. The provided description does not explicitly state that remote code execution is possible, but a local file inclusion flaw is often a stepping stone to that outcome; this conclusion is inferred from the nature of LFI vulnerabilities and is not a claim made by the vendor.

The issue affects all deployments of the ThemeREX Run Gran theme from the initial release through version 2.0. Any WordPress site that has the theme installed, regardless of the WordPress core version, may be vulnerable.

The CVSS score of 8.1 classifies the flaw as high severity, yet the EPSS score of less than 1% indicates a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. Attackers would need to supply a manipulated file path via a vulnerable parameter or user input, and no privileged access is required. While the direct impact is local file inclusion, enabling an attacker to read sensitive files or inject malicious content, the potential for full system compromise or remote code execution remains an inference rather than an explicit vendor statement.