An attacker may exploit a flaw in the Alright theme that allows inclusion of local files on a server, which can result in disclosure of sensitive information or in some cases execution of arbitrary PHP code. The weakness is a classic improperly controlled include/require operation, classified as CWE-98, and has the potential to compromise both data confidentiality and system integrity if an attacker can supply an attacker‑controlled path.

The vulnerability exists in WordPress themes supplied by axiomthemes called Alright, affecting all versions from the earliest releases through version 1.6.1. Users running the Alright theme with these or earlier releases are at risk.

The CVSS evaluation of 8.1 indicates high severity. The EPSS score of less than 1% suggests that, at present, exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. Likely attack requires access to the WordPress installation’s include mechanisms, often via a crafted request within the application. While the vector appears local, the flaw could be leveraged to achieve remote code execution if an attacker can supply an arbitrary PHP file from the server or trigger the inclusion of a script that is already present in the environment.