Improper control of filename parameters in the PHP include/require statements of the Marcell theme allows an attacker to trigger a local file inclusion. This flaw can enable the reading of sensitive files on the server or, if a local PHP file can be uploaded or authored by the attacker, lead to remote code execution on the site. The vulnerability is classified as CWE‑98, which highlights the risk of uncontrolled input being used as a filename.

The issue affects the ThemeREX Marcell WordPress theme up to and including version 1.2.14. Any installation using one of these versions is vulnerable; newer releases are not affected according to the available data.

The CVSS score of 8.1 reflects a high severity, and the EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in the CISA KEV catalog, so no known widespread exploitation is reported. The likely attack vector involves a crafted HTTP request that supplies a file path to the vulnerable include statement, a technique that requires access to the site’s front‑end or an authenticated user context. While the vector is relatively straightforward, successful exploitation depends on the attacker’s ability to influence the filename parameter, which may be limited in some hosting environments.