The vulnerability stems from improper control of the filename in an include/require statement within the Spock theme, allowing a local file inclusion (LFI). An attacker could supply a crafted path that tricks the theme into including arbitrary local files, resulting in disclosure of sensitive information or execution of malicious code if the included file contains attacker‑controlled content. This weakness can compromise confidentiality, integrity, and potentially availability of the affected WordPress installation.

The affected product is the Spock theme released by axiomthemes for WordPress. Versions up to and including 1.17 are impacted. Any WordPress site that has installed this theme during that version range is vulnerable.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the theme’s file inclusion routine, with an attacker needing the ability to influence the path argument—typically via a crafted URL or form input that the theme does not properly sanitize. If successful, the attacker can read or execute arbitrary files present on the server.