The Amuli theme for WordPress includes a flaw in the file–include logic that allows an attacker to supply an arbitrary local file path to the PHP include statement. The vulnerability is identified as CWE‑98 and can be exploited to read sensitive files or execute attacker‑controlled PHP code if such code is present in the chosen file. The primary security impact is local file inclusion, with the potential to evolve into remote code execution if the attacker manages to include a malicious PHP file.

All versions of the AxiomThemes Amuli WordPress theme that are version 2.3.0 or earlier are affected. Users who have upgraded to any release beyond 2.3.0 no longer face this risk.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of <1% suggests a low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted URL or form input that manipulates the file path used by the theme’s include statement; this inference is based on the nature of the flaw and the lack of explicit information in the description. No authentication or administrative privileges are required, and exploitation conditions are minimal: the site must be running a vulnerable theme and the input used to build the file path must be controllable by an external actor.