Improper control of the filename used in a PHP include/require statement allows a local file to be read, leading to potential execution of arbitrary server‑side code. This vulnerability is classified as CWE‑98 and can expose sensitive data or compromise the entire WordPress installation. Attackers who can manipulate the path can gain read access to local files and may execute crafted scripts, resulting in a loss of confidentiality, integrity, and availability of the site.

Affected is the WordPress Tacticool theme distributed by AxiomThemes. Any installation using version 1.0.13 or earlier is vulnerable. The vulnerability applies to all WordPress sites that have this theme active, regardless of other plugins or themes.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of publication. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is through a crafted URL or form input that the theme processes. Once invoked, the LFI can lead to remote code execution in the context of the web server.