The vulnerability is an improper control of filename for an include or require statement, permitting a Local File Inclusion attack. By manipulating the filename parameter used by the theme, an attacker can read arbitrary local files and, if they can provide a PHP file, execute code. This weakness falls under CWE-98, which concerns using uncontrolled input as a filename in requires or includes.

WordPress sites using ThemeREX Save Life theme version 1.2.13 or earlier are affected. Any installation still running these or older versions is vulnerable and should be verified via the WordPress admin interface or the plugin directory.

The CVSS base score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve submitting a crafted request that directs the theme to include a targeted file path, which could be performed by an unauthenticated user if the parameter is publicly exposed. The impact is limited to the server’s file system, but the ability to execute PHP code could elevate the risk substantially if the attacker succeeds.