Technical impact
The vulnerability arises from inadequate validation of a filename used in an include/require statement within the Saxon theme. An attacker controlling the filename can force the PHP interpreter to read or execute arbitrary files on the server. This could expose confidential data or allow the execution of malicious code, resulting in a compromise of confidentiality, integrity, and availability of the WordPress site. The CVSS score of 8.1 indicates a high‑severity threat.
Affected Systems
The affected product is the dedalx Saxon – Viral Content Blog & Magazine Marketing WordPress Theme, versions up to and including 1.9.. No other versions are listed as vulnerable.
Risk and Exploitability
Given the low EPSS score of less than 1 % and the absence of a listing in the CISA KEV catalog, the likelihood of observed exploitation is currently low, but the high CVSS score means that if an exploitation path is discovered, the risk would be significant. The attack vector is inferred to be Local File Inclusion, potentially exploitable through theme settings or URL parameters that influence the include target. Successful exploitation would require an attacker able to supply or influence a file path that is then included by the theme's PHP code.
