This issue allows the Axiomthemes Vocal theme to include arbitrary local files through an unsanitized filename supplied to a PHP include or require statement. The flaw can lead to disclosure of sensitive data contained on the web server or, if the included file contains executable code, remote code execution. The weakness is captured by CWE‑98, making it a classic local file inclusion vulnerability.

The Vulnerability affects the WordPress Vocal theme from Axiomthemes, specifically all releases up to and including version 1.12. No later version is known to be vulnerable.

The CVSS v3.1 score is 8.1, indicating high severity. The EPSS score is < 1 %, which suggests that, as of the data, exploit activity is expected to be very low, and the vulnerability is not catalogued in the CISA KEV list. Nevertheless, because the flaw is local file inclusion, an attacker with any ability to influence the request path to the site—such as a public web interface—could potentially execute the exploit. The risk is mitigated only by limiting the vulnerability’s exposure, but the conservative assessment still recommends urgent remediation.