An improper control of filenames in the WordPress Gamezone theme causes PHP to include and require files without adequate sanitization. This flaw permits attackers to trigger local file inclusion, allowing them to retrieve arbitrary files on the server or, in some circumstances, execute code. If an attacker can supply a path that points to a PHP file, the included content will run with the same privileges as the WordPress process, potentially granting full control over the compromised site.

WordPress sites that are running ThemeREX Gamezone version 1.1.11 or earlier are affected. The vulnerability resides within the theme’s file inclusion logic and therefore only impacts installations that have the Gamezone theme active.

With a CVSS score of 8.1 the risk is high, yet the EPSS score of less than 1 % indicates that no widespread exploitation is currently observed. The flaw requires the attacker to interact with the site’s HTTP interface, delivering a crafted request that triggers the vulnerable include. Because it is a local file inclusion, successful exploitation depends on the presence of readable files or writable directories that can contain malicious PHP code. The risk to confidentiality, integrity, and availability is significant if an attacker can read sensitive files or execute code, but the actual exploitation probability remains low according to current data.