The vulnerability is an unauthenticated Local File Inclusion that allows an attacker to direct the web application to read arbitrary files from the server. Because the Uminex theme fails to validate the file path, sensitive configuration files or PHP scripts could be exposed. This flaw is classified as CWE‑98, which underlines improper handling of file inclusion that can compromise confidentiality of data on the server.

The affected stack is the Kutethemes Uminex WordPress theme. Versions up to and including 1.0.9 are vulnerable. No further sub‑versions are listed, so any release 1.0.9 or earlier should be considered at risk.

The CVSS base score of 8.1 signals a high severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified precisely. The vulnerability is not listed in CISA’s KEV catalog. Attackers with unauthenticated access can supply arbitrary file names to the theme’s inclusion logic, potentially reading system files, database configuration, or other sensitive artifacts on the server. Because the flaw resides in a theme that runs in user‑generated content context, an attacker does not need privileged credentials, but must be able to trigger the vulnerable code path via a crafted URL or request.