This vulnerability results from an improper control of the filename used in an include/require statement in the Renewal theme’s PHP code. It allows an attacker to manipulate a file path argument and read arbitrary files located on the web server. The weakness is classified as CWE-98. Without a safeguard the flaw can expose sensitive files and, if the attacker can supply PHP code, may enable execution of malicious code on the server, compromising confidentiality and potentially integrity.

The issue applies to the axiomthemes Renewal theme for WordPress, affecting all releases from the initial release through and including version 1.2.2. WordPress sites that have deployed any of these theme versions are vulnerable.

The CVSS score of 8.1 labels the vulnerability as high risk. The EPSS score of less than 1% indicates a currently low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The typical attack vector is a local file inclusion via the theme’s insecure handling of user‑controlled input; an unauthenticated user who can influence the request that triggers the vulnerable include could read arbitrary files or potentially load malicious PHP code.