This CVE documents an improper control of filenames used in PHP include/require statements within the Axiom Themes Convex WordPress theme. The flaw allows an attacker to supply a path that the theme will attempt to include, potentially enabling them to read arbitrary local files. Based on the description, it is inferred that the attacker could provide a path that traverses directories and includes a PHP file, which could lead to remote code execution or disclosure of sensitive information.

The Convex theme is affected from the earliest available version through 1.11; any WordPress site running Convex 1.11 or earlier is vulnerable. The vendor is Axiom Themes, and the product is the Convex WordPress theme.

The CVSS score of 8.1 indicates a high severity for this file-inclusion issue. The EPSS score of less than 1% suggests that exploitation is currently rare, but the flaw remains a serious risk for sites that have not applied the patch. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been reported yet. The likely attack vector is a web request that includes a crafted filename parameter used by the theme to include a file; exploitation requires the attacker to supply a local path or a writable location where they can place a malicious file.