The flaw arises from improper control of the filename supplied to an include/require statement in the Legacy WordPress theme, allowing an attacker to read arbitrary files on the local filesystem. An attacker who can trigger the inclusion could read sensitive files such as configuration files, database credentials, or other data, leading to compromise of confidentiality and potentially further attacks such as session hijacking or credential theft. The vulnerability is identified as CWE‑98 and is rated with a CVSS score of 8.1.

The affected product is the Legacy theme provided by AxiomThemes, versions n/a through 1.9 inclusive. Any WordPress installation using the Legacy theme up to and including version 1.9 is susceptible.

The EPSS score for this vulnerability is less than 1%, indicating a low but nonzero probability of exploitation, and it is not currently listed in the CISA KEV catalog. The high CVSS rating reflects a significant potential impact if successfully abused. While the description refers to a local file inclusion, it is likely that a remote attacker can exercise this control via crafted URLs or form input on the WordPress site, making remote exploitation a realistic threat in publicly accessible deployments.