The vulnerability is an improper control of filename for include/require statements in PHP, allowing Local File Inclusion. An attacker can supply a crafted file path that may be read or executed by the web application, leading to disclosure of sensitive data or execution of arbitrary code present on the server. The weakness is classed as CWE-98 and can compromise confidentiality and integrity of the system.

The affected product is the WordPress Katelyn theme authored by Axiom Themes. Versions from the earliest available through 1.0.10 are vulnerable. All sites using these versions of the theme are at risk.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score of less than 1% indicates that exploitation probability is currently low, and it is not listed in the CISA KEV catalog. Likely exploitation requires the ability to influence the file path parameter used by the theme. The attack vector would involve passing a crafted argument to an unvalidated include call, potentially via a public URL or form field. Assuming the application runs as the web server user, an attacker could read or execute local files.