Improper control of the filename in an include/require statement allows a local file inclusion vulnerability in the Axiom Themes Athos WordPress theme. Attackers can supply a crafted filename that is passed to PHP’s include/require function, potentially reading arbitrary files or executing attacker‑supplied code. The vulnerability is classified as CWE-98 and has a CVSS score of 8.1, indicating a high severity level.

Axiom Themes Athos WordPress theme versions up through 1.9 are affected. This includes any installation that has not updated to a later release of the theme.

The likelihood of exploitation is low at present (EPSS < 1%), and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score indicates that a successful exploit could lead to remote code execution or sensitive data disclosure. Likely attack vectors involve application inputs that determine the file path for inclusion, such as theme option fields or URL parameters that are not properly validated. The absence of authentication requirements in the description suggests that the vulnerability could be exploitable by unauthenticated users who can manipulate these inputs.