Improper control of filenames in the include/require statements of Axiomthemes Marveland allows attackers to read or execute files from the local file system. The vulnerability arises because the theme does not validate or constrain the path supplied to PHP's include/require functions, enabling arbitrary file access. If an attacker can supply a crafted path, they may read sensitive files such as configuration, or, if the included file contains executable code, trigger remote code execution on the server.

Axiomthemes Marveland theme, versions n/a through 1.3.0, is affected. Any installation running these versions is vulnerable until a patch or upgrade removes the insecure include logic.

The CVSS v3 score of 8.1 highlights a high severity risk, and the EPSS score of less than 1 percent indicates that exploitation is currently rare, yet not impossible. The vulnerability is not cataloged in CISA's KEV list, suggesting no widely known exploits yet. The likely attack vector is through a web request that supplies a value used by the theme as a filename, allowing remote attackers to influence the include path. Successful exploitation would grant the attacker read access to arbitrary files on the server, and potentially the ability to execute malicious code if a PHP file can be placed on the filesystem.