The vulnerability arises from improper control of the filename that is passed to a PHP include/require statement within the Axiomthemes Fermentio WordPress theme. An attacker who can influence the path used in this statement can cause local files to be read or PHP code to be executed under the web server’s context. This flaw allows the attacker to read configuration files, credentials, or other sensitive data stored on the server, and potentially inject malicious code that could be executed thereafter, thereby compromising the confidentiality, integrity, and availability of the affected site.

All installations of the Fermentio theme released by Axiomthemes up to and including version 1.5.0 are impacted. This includes any WordPress site that has the theme applied without a later, fixed version. No other products or vendor components are mentioned as affected.

The CVSS score of 8.1 categorizes this flaw as high severity. The EPSS score is not available, so the current exploitation probability remains unknown, but the absence of an EPSS does not imply the flaw is unexploited; the flaw is also not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could likely exploit this vulnerability through crafted input to the theme’s include logic, potentially via a URL parameter or form submission that the theme processes without proper validation. Once exploited, the attacker may read any file on the server or inject executable PHP code, leading to full site compromise.