This vulnerability involves improper control of the filename parameter used in PHP include or require statements within the ThemeREX M.Williamson theme. It allows an attacker to perform Local File Inclusion (LFI), potentially leading to remote code execution or disclosure of sensitive files. The issue affects all versions up to 1.2.11. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, users should consider disabling or removing the vulnerable theme or applying temporary mitigations such as restricting access to vulnerable PHP files if possible.