A Cross‑Site Request Forgery flaw in the looswebstudio Arkhe WordPress theme allows an attacker to force a logged‑in user to submit a crafted request that triggers PHP Local File Inclusion. The vulnerability can lead to execution of arbitrary PHP code, allowing an attacker to compromise the entire site, exfiltrate data, or perform further attacks within the controlled environment. The weakness is identified as CWE‑352, indicating that the attacker can bypass authorization checks by forging requests on behalf of an authenticated user.

WordPress sites using the Arkhe theme from its earliest releases through version 3.12.0 are affected. The theme is distributed by looswebstudio and is commonly found on multiple websites that have not yet migrated to newer releases.

The CVSS score of 8.1 classifies the vulnerability as high, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog. The likely attack vector is a forged request from a malicious actor targeting a victim who is logged into the site, leveraging the vulnerability before the user is aware of the request.