The Promo theme for WordPress, supplied by AxiomThemes, contains an unauthenticated local file inclusion flaw that allows an attacker to read arbitrary files on the server. The vulnerability arises from inadequate validation of file paths, permitting users to specify local file locations. An attacker exploiting this weakness could expose sensitive configuration files, credentials, or other data, thereby compromising confidentiality and potentially facilitating further attacks. The primary CWE associated with this flaw is CWE‑98, indicating a lack of proper file path sanitization.

Any WordPress installation that has the Promo theme version 1.3.0 or earlier enabled is affected. Users of earlier releases should verify the theme version and consider upgrading if possible.

The CVSS score of 8.1 marks this as a high‑severity vulnerability. Because the flaw is unauthenticated and operates via the web interface, the likely attack vector is remote. The EPSS score is not reported, but the absence of a KEV listing means no confirmed public exploits are currently catalogued. Nevertheless, the combination of high CVSS and remote exploitation potential warrants prompt remediation. Existing web application firewalls or access controls may mitigate exposure if the vulnerability cannot be patched immediately.