WordPress Athens theme has a flaw that permits arbitrary local file inclusion due to uncontrolled filename parameters in PHP include/require calls. This weakness, identified as CWE-98, allows an attacker to read or execute files on the server, which can lead to code execution or exposure of sensitive configuration data. The vulnerability is marked with a CVSS score of 8.1, indicating a high severity level with potential for significant impact if exploited.

The issue affects ovatheme Athens theme versions up to and including 1.1.6, impacting any WordPress installation that uses that theme with those versions.

The risk is quantified by the CVSS 8.1 score, but the EPSS score of less than 1% signifies a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed exploits. The likely attack vector is a remote actor manipulating input to the theme's inclusion logic, possibly via crafted URL parameters or content that triggers the include. However, explicit details about the exact attack path are not provided in the advisory, so the precise exploitation method remains inferred.