Improper control of the filename used in PHP include/require statements allows an attacker to give a value that alters the file path that PHP loads. The local file inclusion flaw enables reading arbitrary files on the web server, which could expose sensitive configuration data or credentials. In worst‑case scenarios, the inclusion of executable files or manipulation of the include path may lead to remote code execution, thereby compromising the confidentiality, integrity, and availability of the site.

AxiomThemes Pinevale WordPress theme, all releases up to and including version 1.0.14. Any WordPress site that has installed Pinevale through its initial release until that point is affected.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Its EPSS score is below 1 %, implying that large‑scale exploitation has not been observed, and it is not listed in CISA KEV. The typical attack vector is a web request that supplies a crafted parameter to influence the include path, and the vulnerability does not require authentication on a standard site installation.