The affected WordPress theme contains an improper filename control for include/require statements, allowing attackers to include arbitrary local files. This weakness, identified as CWE‑98, can expose sensitive files and compromise the confidentiality and integrity of the site content.

Versions of the Assembly theme released by Axiomthemes from the initial release through 1.1 are vulnerable. Any site using Assembly 1.1 or earlier is at risk.

The CVSS score of 8.1 classifies this issue as high severity, while the EPSS score of less than 1% indicates a low current threat likelihood. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. Based on the description, the likely attack vector involves remotely accessing the theme’s PHP code paths that perform file inclusion, requiring the attacker to supply a crafted filename parameter. The lack of explicit authentication requirements suggests that the flaw could be exploitable by unauthenticated users, but this is inferred rather than stated in the data.