The Paragon WordPress theme, versions 1.1 and earlier, contains an improper control of filename in an include/require statement. This flaw permits an attacker to manipulate the file path used by the PHP include, enabling the inclusion of arbitrary local files. The attacker could read sensitive configuration files or execute code if a malicious script is included, potentially compromising site confidentiality and availability.

Any WordPress installation running AxiomThemes Paragon theme version 1.1 or earlier is affected. The vulnerability is present in every release from the initial release up to and including 1.1.

The CVSS score of 8.1 indicates a high severity. The EPSS score of fewer than 1% shows a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, a likely attack vector involves passing a user‑controlled value to the include statement, either via a front‑end request or through administrative input. If the include statement causes execution of the file, remote code execution could result. The risk remains high if exploitation occurs, especially on publicly accessible sites.