The vulnerability arises from an improper control of the filename used in a PHP include or require statement, allowing a local file inclusion (LFI) attack. An attacker could exploit this weakness to read arbitrary files from the server or execute code that is already present on the filesystem, potentially leading to disclosure of sensitive data or compromising the integrity of the WordPress installation. The weakness is identified by CWE‑98.

The issue affects WordPress sites using the CreativeWS MetaMax theme, specifically all releases through version 1.1.4. Any site with this theme installed at a vulnerable version is susceptible.

The CVSS score of 8.1 indicates high severity. EPSS shows an exploit probability of less than 1%, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is local file inclusion triggered by a crafted request that feeds a malformed filename into the theme’s PHP code. Exploitation requires the attacker to send a request to the target WordPress site and may be limited by web‑server permissions, but once successful it can lead to unauthorized file access or code execution.