This vulnerability arises from improper validation of filenames used in PHP include or require statements within the Towny WordPress theme. An attacker could supply a crafted path that forces the server to read or execute arbitrary local files, potentially revealing confidential data or executing malicious code. The weakness is classified as CWE-98, indicating an insecure file inclusion flaw.

The Towny theme by Axiom Themes is affected, specifically all releases up to and including version 1.16. Users running these versions on WordPress sites should identify whether the theme is active and determine the installed version.

The CVSS score of 8.1 marks this issue as high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog, but the high severity warrants prompt attention. The likely attack vector, though not explicitly described, would involve an attacker tricking a logged‑in or public user into loading a malicious local path through a vulnerable parameter or URL. If successful, this could read system or configuration files or execute PHP code.