The vulnerability is a Local File Inclusion flaw identified as CWE-98. Improper validation of filename arguments in the Confidant WordPress theme allows an attacker to include arbitrary files on the web server. An attacker could potentially execute malicious PHP code or read sensitive files, which could lead to loss of confidentiality, integrity, or even remote code execution if vulnerable files are included.

The Defect affects the Axiomthemes Confidant WordPress theme version 1.4 and all earlier releases. Users running any of those versions are at risk.

The CVSS score of 8.1 reflects high severity, while the EPSS score is not provided so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely occur via a crafted web request that supplies a malicious file path to the theme’s include routine, giving the attacker local file access within the web server context.