The Kayon theme for WordPress contains an improper control of the filename that leads to a PHP Local File Inclusion flaw. An attacker can supply crafted input that resolves to an arbitrary file when the theme performs an include or require, allowing the server to read sensitive files or execute attacker‑supplied PHP code if a PHP file can be accessed or uploaded. This can compromise confidentiality, integrity, and may ultimately lead to full site compromise.

All WordPress installations using the ThemeREX Kayon theme version 1.3 or earlier are vulnerable. The flaw spans every release of the theme up to and including 1.3, with no later versions indicated as affected.

The CVSS score of 8.1 signals high severity. The exploit probability score is less than 1 %, indicating that exploitation is unlikely at present. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote via an HTTP request that supplies a crafted parameter or path that the theme uses in an unsanitized include or require call. An attacker only needs the ability to send requests to the affected WordPress site; no privileged access or local compromise is required. Successful exploitation could allow reading any file in the webroot or executing PHP code, enabling full site compromise.