The Fillmax WordPress theme contains an improper control of filename for include/require statements, allowing attackers to supply arbitrary file paths to be included by the PHP engine. This vulnerability can grant the ability to read sensitive files and, if a remote file can be accessed, to execute arbitrary code, thereby compromising confidentiality, integrity, and availability of the site.

All installations of the ThemeREX Filmax theme with versions up to and including 1.1.11 are affected. The vulnerability applies to any WordPress instance that has the theme activated, regardless of other plugins or configurations.

The CVSS score of 8.1 indicates a high severity. EPSS is below 1%, so the likelihood of exploitation is considered low, but not negligible. The issue is not yet listed in the CISA KEV catalog, which suggests no publicly available exploit has been confirmed. Based on the description, the most likely attack vector is a local file inclusion via manipulated query parameters or user input, though attackers could achieve remote code execution if an external file can be requested and the allow_url_include directive is enabled. The absence of a known workaround or official patch means the threat persists until the theme is updated.