The vulnerability arises from improper control of the filename used in PHP include/require statements, allowing a malicious actor to supply a crafted path that causes the Muzicon theme to include arbitrary local files. This can expose sensitive configuration files, credentials, or other data and may serve as a foothold for further attacks such as local code execution. Based on the description, it is inferred that the inclusion path might be influenced by user input or URL parameters, even though the exact mechanism is not detailed in the data.

ThemeREX Muzicon theme versions up to and including 1.9.0 are affected. No later versions are listed, so any installation running the theme at or below this version is vulnerable.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, which further indicates a low probability of active exploitation. Based on the description, it is inferred that the attack vector may involve injection of special characters or crafted paths through query strings, form fields, or other user‑controlled inputs, making the threat moderate but potentially serious if the attacker can access arbitrary files or trigger further code execution.