The vulnerability is an improper control of filename used in a PHP include/require statement inside the Catwalk theme. Because the theme accepts a user‑supplied path and passes it directly to PHP, an attacker can cause the server to read arbitrary files, such as configuration, credentials, or possibly execute malicious code if the included file contains PHP. This weakness can result in disclosure of sensitive data or full compromise of the web application.

The issue affects the axiomthemes Catwalk WordPress theme, versions from the earliest release through 1.4. Sites that have not upgraded past version 1.4 are vulnerable.

The CVSS base score of 8.1 indicates high severity. The EPSS score of less than 1% shows that exploitation is currently unlikely, but the vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation activity is reported. The likely attack vector is local file inclusion via crafted URL or form input that points to a file on the server; if the server allows execution of included PHP, the attacker can achieve remote code execution. Successful exploitation would compromise the confidentiality, integrity, and availability of the affected WordPress installation.