ThemeREX Daiquiri theme contains a flaw where the filename passed to PHP include/require statements is not properly validated. This improper control can allow an attacker to force the theme to load a local file of their choosing. If the attacker can include a file containing PHP code or otherwise manipulate the path, the result may be arbitrary code execution or disclosure of sensitive files such as configuration or database credentials.

WordPress sites that have installed or are currently using ThemeREX Daiquiri version 1.2.4 or earlier are affected. The vulnerability applies to all releases from the earliest supported version up to and including 1.2.4. Site administrators should confirm which version of the theme is active and upgrade accordingly.

The CVSS base score of 8.1 indicates high severity. The EPSS score is below 1 %, implying there is a very low probability of exploitation observed in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, local file inclusion remains a potent vector for attackers that can gain file read or write access, potentially escalating to full site compromise. Exploitation would require the attacker to supply a crafted request to the theme that manipulates the include path, which may be feasible over the web if any user‑controlled parameters are passed into the inclusion logic.