This vulnerability arises from improper validation or control of filenames in PHP include or require statements within the ThemeREX MCKinney's Politics theme. It allows an attacker to perform Local File Inclusion (LFI), potentially enabling arbitrary code execution or disclosure of sensitive files. The issue affects versions up to and including 1.2.8. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive information, code execution, and disruption of service on affected installations of MCKinney's Politics theme up to version 1.2.8. This can compromise the entire web server environment hosting the vulnerable theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to the affected PHP files to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.