The Critique WordPress theme contains a Local File Inclusion vulnerability (CWE‑98) that allows an attacker to control the filename in an include/require statement. By manipulating the request, an attacker could read arbitrary local files or execute code placed within them, compromising the confidentiality, integrity, or availability of the web application.

Axiom Themes’ Critique theme is affected in all releases from the initial version up to and including version 1.17. Users running this theme should verify their installed version and update to 1.18 or later if available.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% indicates a low probability of current exploitation. The issue is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted HTTP request to the theme’s PHP entry point that triggers the vulnerable include. Even with low usage probability, the potential impact warrants prompt action.