This vulnerability is an Improper Control of Filename for Include/Require Statement in PHP that allows a local file to be included by the WordPress Aqualots theme. An attacker can craft a request that causes the theme to load arbitrary local files, potentially exposing sensitive configuration files or executing uploaded malicious code. The weakness is a PHP Local File Inclusion type flaw that can compromise confidentiality, integrity, and availability of the affected system.

The ThemeREX Aqualots WordPress theme is affected in all releases up to and including version 1.1.6. Any installation of the theme up to that version is vulnerable, regardless of patch level of WordPress itself.

The CVSS score is 8.1, classifying the vulnerability as high severity. The EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation in the immediate future. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a public HTTP request that reaches the untrusted include routine; authentication is not required if the vulnerability can be triggered via a standard web request. Due to the local file inclusion nature, an attacker could read local files or run code if a writable file is available.