The Crafti theme for WordPress includes a vulnerability where the filename used in PHP include/require statements is not properly validated. This improper control allows an attacker to cause the theme to include arbitrary local files, which can expose sensitive data and may enable the execution of malicious code if the attacker can write to a target file. The weakness is classified as CWE‑98 and can be leveraged by a user who can influence the inclusion path, potentially leading to a local file inclusion scenario.

WordPress sites that use the Axiomthemes Crafti theme version 1.12 or earlier are affected. The vulnerability applies to any installation that has the Crafti theme active and includes the legacy include/require logic.

The CVSS score of 8.1 indicates a high severity and suggests that exploitation is likely if an attacker can influence the inclusion path. The EPSS score is not available, so the exact exploitation probability is unknown, but the lack of KEV listing does not diminish the risk. The most probable attack vector is a local file inclusion attack that an attacker can trigger by manipulating a request that reaches the theme’s include logic, either by direct input or by exploiting another component that passes unsanitized parameters.