The Manufactory theme includes PHP code that fails to validate filenames supplied to include/require statements, allowing local file inclusion. This flaw can enable an attacker to read sensitive files on the server or execute arbitrary PHP code if crafted input is processed, thereby compromising confidentiality and integrity of the site.

AxiomThemes’ Manufactory WordPress theme, any installation using version 1.4 or earlier, applies to all affected builds from the earliest release through v1.4.

The CVSS score of 8.1 marks the vulnerability as high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation at present. It is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is local file inclusion via the theme’s unvalidated include paths, requiring an attacker to leverage some form of input that changes the filename used by the theme. This underscores the need for prompt remediation to prevent potential data disclosure or code execution.