The Conquerors theme from Axiomthemes has an improper control of the filename used in a PHP include/require statement, allowing attackers to trigger a local file inclusion (LFI) vulnerability. This flaw permits reading arbitrary files from the webserver’s filesystem, which can reveal sensitive configuration data, passwords, or other confidential information. In some scenarios, an LFI can be leveraged to execute malicious PHP code, potentially leading to full compromise of the website.

WordPress installations that use the Conquerors theme from Axiomthemes, specifically versions n/a through 1.2.13 inclusive.

The vulnerability has a CVSS score of 8.1, indicating a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Likely attack vectors involve a web user manipulating a parameter that the theme uses in an include/require call, enabling the inclusion of local files such as /etc/passwd or other configuration files. Successful exploitation could lead to confidential data leakage or code execution if the attacker controls the content of the included files.