WordPress Nirvana theme versions up to 2.6 suffer from an improper control of filenames in an include/require statement. This Local File Inclusion flaw, classified as CWE‑98, allows an attacker to read arbitrary files from the server and can serve as a stepping stone for arbitrary code execution. The high CVSS score of 8.1 reflects the potential for severe confidentiality, integrity, and availability impacts.

The vulnerability affects the AxiomThemes Nirvana theme, specifically all releases through version 2.6. WordPress sites using these theme editions are exposed, regardless of the overall WordPress core version. If a site has installed a protected or older theme, the risk is mitigated, but any site still running 2.6 or earlier must update.

The CVSS score indicates a high severity, yet the EPSS score of <1% suggests that, at present, exploitation attempts are rare. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a request that influences the theme’s include logic, typically by manipulating query parameters that are inserted directly into the file path. No authentication requirement is explicitly stated, so the path may be exploitable by unauthenticated users if the theme processes external input. The flaw stems from insufficient input validation and the ability to resolve relative or absolute paths.