The Soleng theme for WordPress contains a Local File Inclusion flaw that permits an attacker to supply a filename to an include/require statement. Based on the description, it is inferred that this weakness allows the attacker to read arbitrary files from the local filesystem, potentially exposing sensitive data. This vulnerability, labeled as CWE-98, threatens confidentiality and integrity by making local files accessible to unauthorized parties.

The issue affects the Soleng theme from axiomthemes, for all releases up to and including version 1.0.5. Any site using versions up to 1.0.5 is potentially vulnerable.

With a CVSS score of 9.8 the flaw is classified as critical. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that LFI can be triggered by any user who can influence the include parameter, giving the attacker broad potential for exploitation. The likely attack vector involves crafting a request that supplies a crafted filename to the vulnerable code path, triggering unintended file inclusion.