The vulnerability is an improper control of the filename used in a PHP include/require statement, allowing an attacker to include arbitrary local files. This can enable reading of sensitive files or execution of malicious PHP code if a crafted file is uploaded, leading to possible compromise of the WordPress site.

The axiomthemes Photolia theme for WordPress is affected. All releases from the first version through 1.0.3 inclusive are vulnerable; version 1.0.4 and later are not impacted.

With a CVSS score of 8.1, the flaw represents a high severity risk. The EPSS score of less than 1% indicates a very low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote or local input that manipulates the file path used by PHP’s include statement, such as by sending crafted URLs or form submissions within the affected WordPress site.