The Artrium WordPress theme contains an improper control of filename for include/require statements, allowing an attacker to force inclusion of arbitrary local files. This can expose sensitive configuration, user data, or, if the included content is executable PHP, enable remote code execution, potentially leading to full site compromise. The weakness is categorized as CWE‑98.

WordPress sites that employ the ThemeREX Artrium theme version 1.0.14 or earlier are affected. All installations of the theme up to and including 1.0.14 contain the vulnerable code; later versions are not impacted.

The CVSS score of 8.1 places this issue in the high severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. This vulnerability is not listed in the CISA Key Exploited Vulnerabilities catalog. Likely exploitation involves manipulating a request parameter that feeds a filename into the theme’s include/require logic; no explicit authentication requirement is stated, suggesting that publicly accessible endpoints may be vulnerable.