The flaw stems from an uncontrolled filename in a PHP include/require statement, permitting attackers to supply crafted inputs that resolve to arbitrary local files on the server. This could expose sensitive data or allow execution of unintended code if the included file contains executable logic. The vulnerability is identified as a Local File Inclusion issue (CWE‑98).

WordPress installations utilizing the axiomthemes Fabric theme version 1.5.0 or earlier are affected. The theme is deployed under the Fabric name and is supplied by axiomthemes.

The CVSS score of 8.1 classifies the vulnerability as high severity, while the EPSS score of <1% indicates a low but non‑zero likelihood of exploitation at present. Because the issue is triggered via a web‑exposed input, the attack vector is network‑based, potentially granting attackers access to confidential files, altering site integrity, or impacting availability. Although the vulnerability is not listed in CISA's KEV catalog, administrators should treat it with elevated priority to prevent possible compromise.