Improper control of filename for include/require statements in the ThemeREX Sounder WordPress theme permits local file inclusion, allowing an attacker to read or execute arbitrary server files. This can lead to disclosure of sensitive configuration files or the execution of malicious PHP code, compromising confidentiality and integrity. The flaw falls under CWE‑98, a weakness in program functionality controlling file access.

WordPress sites that use ThemeREX Sounder versions up to and including 1.3.11 are affected. The vulnerability is present from the first release of the theme through any installation running version 1.3.11 or earlier.

The CVSS base score of 8.1 indicates high severity, while an EPSS score below 1 % suggests a relatively low probability of exploitation. The flaw is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the weakness by manipulating user‑controlled parameters that influence the include/require path, potentially leading to the inclusion of sensitive files or executing PHP code if the server permits. Given the absence of widespread exploitation reports, organizations should monitor for suspicious activity and prioritize remediation.