An improper control of filename in PHP include/require statements in the WordPress Little Birdies theme allows local file inclusion. Because the theme accepts user-controlled parameters to determine the file path, an attacker can supply arbitrary paths to sensitive files or inject code, potentially leading to remote code execution. The weakness is classified as CWE‑98 and is reflected in a CVSS score of 8.1, indicating a high severity vulnerability.

Vulnerability affects the Little Birdies theme developed by AxiomThemes. All releases from the first available version up to and including 1.3.16 are impacted. Users running WordPress with this theme in any of those versions are at risk.

According to the latest metrics, the CVSS score is 8.1, positioning the issue as high severity. The EPSS score is below 1 %, suggesting a low but non‑zero probability of active exploitation, though not yet reported in the CISA KEV catalog. The flaw is exploitable via a local file inclusion attack that can be triggered by feeding crafted input to the theme’s include logic, allowing the attacker to read or execute arbitrary files on the server.