An improper control of filenames in the Atlas WordPress theme’s include/require statements permits an attacker to trigger a PHP Local File Inclusion. This vulnerability, identified as CWE‑98, can allow the inclusion of arbitrary files residing on the web server. Consequently, sensitive configuration files, credential stores, or other data may be exposed to the attacker, creating a potential path for further compromise of the site.

The affected product is the TMRW‑studio Atlas theme for WordPress. All versions up to and including 2.1.0 are impacted.

The CVSS score is 8.1, indicating a high severity risk. The EPSS score is < 1%, implying that, at present, exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been confirmed. The likely attack vector is through a crafted web request that causes the theme to include a local file, supplied by an attacker via a URL parameter or form input. Mitigation requires patching or removal of the vulnerable code.