Improper control of file names in PHP include/require statements within the Axiomthemes Kicker theme creates a local file inclusion vulnerability that could allow an attacker to read arbitrary files on the server or execute malicious code if the included file is under the attacker's control. This weakness is identified as CWE‑98 and can lead to compromise of confidentiality, integrity, or availability if the attacker succeeds.

Axiomthemes Kicker versions from the first release through 2.2.0 are affected. Users running any of these releases on a WordPress installation should treat the theme as vulnerable and take remediation steps.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score is less than 1 %, indicating a low to very low probability of exploitation at this time, and it is not currently listed in the CISA KEV catalog. Attackers would need to supply a crafted filename via the theme’s code path; the flaw can be exploited remotely over the network, but the entry point is a user‑controllable parameter within WordPress, meaning that an authenticated or unauthenticated remote user could trigger the inclusion if the theme processes requests in that manner. Given the high impact and low current exploitation likelihood, the system should still be patched promptly.