WordPress theme 777 has a local file inclusion flaw that allows an attacker to specify arbitrary file paths in an include statement. The problem is caused by insufficient validation on the filename used in a PHP include/require call, enabling the reading or execution of files on the server. Successful exploitation could lead to disclosure of sensitive configuration data, local code execution, or other compromise of the site.

The vulnerability affects axiomthemes 777 triple‑seven theme for WordPress version 1.3 and earlier. Users deploying the theme with any compatible WordPress installation are at risk if the theme remains at or below version 1.3.

The CVSS base score of 8.1 indicates high severity. The EPSS score of less than 1% suggests very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, most likely via crafted URLs or forms that include a controlled filename parameter. Attacking the site would normally require network access to the application and the ability to influence the file path supplied to the theme’s include logic.