The axiomthemes Renewal product versions up to 1.2.2 contain a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control allows for PHP Local File Inclusion, which can enable an attacker to include arbitrary files on the server. The CVSS score is 8.1, indicating a high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided in the available data.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.