The Rhodos theme contains an improper control of filenames used in PHP include/require statements. An attacker can manipulate these paths to load arbitrary files that are readable by the web‑server process. This local file inclusion flaw could expose configuration files, passwords, or other confidential data. If user input is interpreted as executable PHP code, the vulnerability could be chained to remote code execution.

WordPress sites that have installed Axiomthemes’ Rhodos theme version 1.3.3 or earlier are affected. The flaw is present in every release up to and including 1.3.3, regardless of other WordPress configuration settings.

The CVSS base score of 8.1 categorizes the vulnerability as high severity. EPSS is reported as less than 1 %, indicating a low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a local‑file‑inclusion accessed via web requests that the theme processes without proper validation of the filename component, potentially allowing attackers to read or execute arbitrary files.