An improper control of the filename used in an include/require statement allows an attacker to manipulate the path of files included by the RexCoin WordPress theme. This weakness, classified as CWE‑98, could enable the attacker to read arbitrary files from the server or execute attacker‑supplied PHP code, leading to full compromise of the application environment.

WordPress installations that employ the ThemeREX RexCoin theme version 1.2.6 or older are susceptible. The vulnerability exists in all releases from the initial launch through 1.2.6, impacting sites that have not updated the theme to a newer release.

The CVSS base score of 8.1 indicates high severity, and the EPSS probability is less than 1 %, suggesting a low but non‑zero likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting crafted input that alters the include path, potentially allowing the execution of arbitrary code or disclosure of sensitive files.