This vulnerability arises from improper control of filenames in an include/require statement within the WordPress PJ | Life & Business Coaching theme. The flaw permits the inclusion of arbitrary local files, enabling an attacker to read sensitive files on the server. The impact is the disclosure of confidential data and potentially other critical configuration files, compromising the confidentiality and integrity of the website.

The affected product is the WordPress PJ | Life & Business Coaching theme developed by axiomthemes. All releases from the initial version up through 3.0.0 are vulnerable. WordPress sites that have deployed any of these theme versions are susceptible.

The CVSS score of 8.1 reflects a high severity, while the EPSS score of less than 1% indicates a relatively low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local file inclusion triggered by user‑supplied input that determines the file to include. An attacker who can manipulate that input could read arbitrary files on the server, although no public exploit is known at this time.