The Basil theme for WordPress fails to properly validate the filename used in PHP include/require statements, allowing attackers who can influence the parameter to include arbitrary local files. This vulnerability can lead to disclosure of sensitive server files, execution of attacker‑supplied code, and full compromise of the website. The weakness is classified as CWE‑98. The potential impact escalates from data exposure to complete system compromise when the included file contains executable code.

AxiomThemes Basil theme, WordPress, affects all releases from the initial version up through 1.3.12. Sites running any of these versions may be vulnerable.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests exploitation probability is currently low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve an attacker sending a crafted request to the site that points the include path to a local file, such as via a specially crafted query parameter or form input. Authenticated administrators with theme files access could readily exploit this flaw if the application exposes the vulnerable include point.