Improper control of the filename used in a PHP include/require statement allows an attacker to specify arbitrary local files for inclusion. This flaw is present in Catamaran versions up to and including 1.15. If an attacker can supply a filename that resolves to a PHP file, the included code could be executed, leading to full control of the web application.

All WordPress sites that use the Catamaran theme by Axiom Themes with version numbers not exceeding 1.15 are affected. The vulnerability is identified as CWE‑98 and has been fixed in releases newer than 1.15.

The CVSS score of 8.1 classifies this as high severity, while the EPSS score of less than 1% indicates that public exploitation attempts are currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a web request that contains a user‑controlled parameter feeding into the include/require call; the advisory does not explicitly state required access, so this is inferred from typical LFI patterns.