An improper control of the filename used in PHP include or require statements in the AxiomThemes Jude WordPress theme allows local file inclusion. The vulnerability enables an attacker to specify arbitrary file paths that the theme will attempt to load, potentially exposing sensitive local files or executing malicious code present on the server. Based on the description, it is inferred that this occurs when user‑supplied parameters are used directly in include statements. If an attacker can cause the theme to include a file containing PHP code, they could gain remote code execution, compromising confidentiality, integrity, and availability of the affected website.

The affected product is the AxiomThemes Jude WordPress theme, version 1.3.0 and earlier. All installations of this theme running those versions are susceptible until the theme is updated past 1.3.0.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score is below 1 percent, suggesting that exploitation may be rare at present, but the vulnerability is not catalogued by CISA as a known exploited vulnerability. Based on the description, it is inferred that attackers could exploit this weakness by manipulating the theme’s include logic through crafted URL parameters or theme settings to reference local files. Successful exploitation could result in disclosure of configuration files, application credentials, or execution of arbitrary PHP code if the included file contains malicious scripts.