This vulnerability is a PHP Local File Inclusion flaw in the Rentic WordPress theme that allows an attacker to control the filename passed to include/require statements. The issue can be used to read arbitrary files on the server, and if the attacker can manipulate the include path to execute PHP code, it may lead to remote code execution. The weakness is classified as CWE‑98.

The affected product is the Rentic theme from AxiomThemes, compatible with WordPress. All released versions up to and including 1.1 are impacted.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low overall likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. Exploitation would typically involve sending a crafted URL or form input that redirects the theme’s file inclusion to a local file of the attacker’s choosing. This attack requires the ability to influence the theme’s include parameters, which may be possible through exposed endpoints or logged-in user access, but does not appear to have a readily available public exploit.