The Gig plugin for WordPress contains a Local File Inclusion flaw, identified as CWE-98, caused by insufficient validation of filenames passed to PHP include/require calls. An attacker can supply arbitrary file paths to the vulnerable endpoint, causing the theme to read or include files located on the server. In the worst case, if attacker-controlled writable files are used, remote code execution is possible. The impact ranges from disclosure of sensitive configuration files to full site compromise, affecting confidentiality, integrity, and availability.

All deployments of Axiomthemes The Gig theme up to and including version 1.18.0 are affected; any WordPress site running this theme with those versions is vulnerable.

The CVSS score of 8.1 indicates high severity, while an EPSS score of <1% indicates that exploitation is currently rare but still possible. The vulnerability is publicly reachable by forging a specific HTTP request that steers the include path. Because the theme executes in the context of the WordPress installation, an attacker could read arbitrary files or inject malicious code, creating a critical entry point. The issue is not listed in CISA’s KEV catalog.