This vulnerability allows an attacker to control the filename used in a PHP include/require statement, permitting local file inclusion. The consequence is that sensitive files can be read or that arbitrary code may be executed if a malicious or attacker‑controlled file is loaded. The listed CWE is 98, indicating lack of proper validation of included file paths.

AxiomThemes Prisma WordPress theme versions up to and including 1.10 are affected. The issue persists from the first available version through 1.10 and does not extend to any newer releases.

The CVSS score of 8.1 classifies the flaw as high severity, while the current EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The likely attack vector is local file inclusion via crafted input to the theme, potentially triggered by a configured URL parameter or other exposed input point. Because the flaw involves including arbitrary local files, an attacker could read configuration files, passwords, or exploit server‑side script execution if the included file contains PHP code.