The vulnerability in the WordPress Smart SEO theme allows an attacker to control the filename used by an include or require statement in PHP. Because the filename is not properly validated, the application may include arbitrary files from the local filesystem. An attacker could read sensitive files or, if the attacker can write to a location that will be included, could execute arbitrary PHP code, effectively compromising the website.

The Smart SEO theme from Axiom Themes is affected for every release up to and including version 2.12. Versions prior to the release of the fix are vulnerable. No other products or vendors are listed in the CNA data.

The CVSS score of 8.1 indicates a high severity exploit. The EPSS score of less than 1% suggests that although exploitation is possible, it is not common. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web attacker who can supply a crafted request that causes the theme to include an attacker‑controlled file. If the attacker can write to a path that will be included, they may gain remote code execution. The weakness is classified as CWE‑98, improper control of filename used for include/require.