The vulnerability is an improper control of filename in a PHP include/require statement, classified as CWE-98. It allows attackers to cause Local File Inclusion on a WordPress site that uses the Beautique theme. By manipulating the filename parameter, an attacker could read arbitrary files or, if writable files are included, execute malicious PHP code, resulting in full server compromise. The severity is high with a CVSS score of 8.1.

The bug affects the axiomthemes Beautique WordPress theme in all releases up to and including version 1.5. Any WordPress installation using this theme in these versions is vulnerable.

The EPSS score is below 1%, indicating a low likelihood of exploitation at present, and the issue is not recorded in CISA’s KEV catalog. Nevertheless, the CVSS rating of 8.1 signals a high potential for serious impact if exploited. A likely attack vector involves a crafted HTTP request to a theme script that accepts an unvalidated filename, enabling inclusion of local files from the web server’s filesystem.