Technical impact
This vulnerability in the Axiomthemes Racquet WordPress theme is an improper control of the filename used in include/require statements in PHP, identified as CWE‑98. If exploited, an attacker can cause the server to include arbitrary local files, potentially leading to execution of malicious code or disclosure of sensitive information. The impact is severe, affecting content integrity, confidentiality, and availability of the affected system.
Affected Systems
Affected systems are WordPress sites using the Racquet theme from any version up to and including version 1.12.0. The theme is distributed by Axiomthemes. No specific sub‑versions are listed beyond the upper bound, so all releases through 1.12.0 are considered vulnerable.
Risk and Exploitability
The CVSS score of 8.1 categorizes this flaw as high severity, and its exploitation is likely if an attacker can supply or influence the filename used in the include statement. While a formal EPSS score is not available, the absence of a KEV listing does not diminish the risk; the vulnerability remains actively exploitable. The attack vector is inferred to be through user‑controlled input or theme options that set the filename, enabling local file inclusion and potentially remote code execution.
