The Palatio theme for WordPress incorporates an include/require statement that improperly validates the file name supplied by a user, enabling a local file inclusion (LFI) vulnerability classified as CWE‑98. This flaw can let an attacker read arbitrary files on the server or include malicious code, potentially compromising the confidentiality, integrity, or availability of the hosting environment.

AxiomThemes Palatio theme version 1.6 and earlier for WordPress installations are affected. Any WordPress site using the Palatio theme at or below version 1.6 is vulnerable.

The vulnerability has a CVSS score of 8.1, indicating high severity, while the EPSS score is below 1 %, suggesting a low but non‑zero likelihood of exploitation. It is not listed in CISA’s KEV catalogue. Exploitation would likely involve crafting a request that manipulates the include path exposed by the theme, potentially originating from unauthenticated or authenticated contexts. If the file inclusion is accessible without further privileges, an attacker can read sensitive files; if it permits code execution, the attacker could gain full control of the site.