This vulnerability arises from an improper control of filenames used in include/require statements within PHP code of the Tripster theme. When exploited, an attacker can cause the server to include and execute local files, potentially allowing the disclosure of sensitive configuration files or the execution of arbitrary code if the included file is PHP code. The impact is a local file inclusion that can lead to both data compromise and remote code execution depending on the files accessible to the web application.

Axiom Themes’ Tripster WordPress theme, version 1.0.10 and earlier. Any WordPress installation that has this version of the theme active and accessible is affected.

The vulnerability has a CVSS score of 8.1, indicating high severity, while the EPSS score is below 1%, suggesting a low but nonzero probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local file inclusion attack that can be triggered by supplying a crafted filename parameter to the theme’s include logic, probably without requiring authentication.