The vulnerability is a PHP Local File Inclusion flaw caused by inadequate validation of filenames used in include/require statements. It is formally classified as CWE‑98. An attacker could read arbitrary files from the server, exposing sensitive configuration or code content. The flaw does not explicitly guarantee remote code execution, only the ability to retrieve files through the vulnerable include logic.

WordPress installations that use the ThemeREX WealthCo theme version 2.18 or earlier are affected. The issue exists from the earliest released version through 2.18 and is not limited to a narrower sub‑range.

The CVSS score of 8.1 signals high severity. The EPSS score of less than 1 percent indicates a very low observed exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted HTTP requests to manipulate the include path, and while no active exploitation reports are attached to this CVE, the high severity justifies proactive mitigation.