Improper control of the filename used in PHP's include/require functions in the Pantry theme allows an attacker to request arbitrary local files to be included. This local file inclusion flaw, classified as CWE‑98, can enable the attacker's reading of sensitive data such as WordPress configuration files, user data, or database credentials. Based on the description, it is inferred that if the attacker can point the include to a file containing PHP code, that code may be executed by the web server, potentially leading to remote code execution.

All versions of the Pantry theme distributed by AxiomThemes for WordPress, from its initial release through version 1.4, are affected. WordPress sites that have installed the Pantry theme at any of those versions are vulnerable, regardless of the specific server environment.

The CVSS score of 8.1 classifies the vulnerability as high severity. EPSS indicates a very low probability of exploitation, with the score in the <1 % band, and it is not listed in the CISA KEV catalog. The likely attack vector involves an external user supplying a crafted file path through a public endpoint or the theme’s administrative interface; based on the description, it is inferred that the attacker would need to influence the path parameter to point to an arbitrary local file.