A flaw in the stmcan RT‑Theme 18 | Extensions WordPress plugin allows an attacker to supply an arbitrary filename to an unchecked include/require call in the PHP code. The vulnerability results in local file inclusion, which can expose sensitive files. Based on the description, it is inferred that in environments where the server’s PHP configuration enables "allow_url_include", the local file inclusion could facilitate remote code execution. The impact is primarily loss of confidentiality and integrity of server files, with potential for full site takeover if arbitrary code execution were possible.

The issue affects WordPress installations that have the RT‑Theme 18 | Extensions plugin at any release through version 2.5. Any site running a vulnerable build of this plugin is at risk, regardless of other security controls.

The CVSS score of 8.1 indicates a high severity vulnerability that could allow an attacker to gain access to server files. The EPSS score of < 1 % (approximately 0.4 %) suggests that exploitation is currently rare, yet not impossible. The flaw exists in an include/require call that accepts an unvalidated filename, allowing an attacker to perform local file inclusion by sending an HTTP request to the vulnerable plugin endpoint. If the site’s PHP configuration has allow_url_include enabled, remote code execution might be possible, inferred from the description. The vulnerability is not currently listed in the CISA KEV catalog.