This vulnerability arises from an improper control of the filename used in PHP include/require statements within the Redy WordPress theme. The flaw allows an attacker to influence which file is included, leading to Local File Inclusion. Depending on the attacker’s access to the server, this can result in sensitive information disclosure and, if a malicious file can be served, remote code execution. The weakness is classified as CWE‑98 and carries a CVSS score of 8.1, indicating a high potential for damage if exploited.

All installations of the Redy theme by axiomthemes with a version of 1.0.2 or earlier are affected. No further sub‑version details were provided, so any build of Redy released before or at 1.0.2 is vulnerable.

The estimated exploit probability is low, with an EPSS score of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the defect can be exploited locally on the WordPress installation and requires the attacker to trigger the include with a crafted filename. While the low EPSS suggests limited current exploitation, the high CVSS score and the nature of LFI mean the risk remains significant if the site is not promptly patched.