The vulnerability originates from improper validation of filenames in include/require calls within the Stallion theme, creating a file inclusion flaw (CWE‑98). An attacker could force the theme to include arbitrary files from the server’s file system, potentially leading to disclosure of sensitive data or execution of unintended code if the included file contains malicious payloads.

The flaw exists in all releases of the Stallion theme up to and including version 1.17. The affected vendor is Axiom Themes, product Stallion. WordPress sites that have not already updated beyond v1.17 are vulnerable when the theme consumes user‑controlled input that is passed to its include logic.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests that the probability of exploitation is currently very low. The vulnerability is not listed in CISA’s KEV catalog, implying it has not been widely observed in the wild yet. Based on the description, the likely attack vector is through local requests that allow inclusion of arbitrary files on the system, so the risk remains real for sites using older theme versions.