This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the AC Services WordPress theme by axiomthemes. Specifically, it allows PHP Local File Inclusion, where an attacker can manipulate the filename parameter to include local files on the server. The affected versions are up to and including 1.2.5. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation. No patch or official fix details have been provided by the vendor or in the advisory.

Successful exploitation could lead to local file inclusion on the affected web server, potentially exposing sensitive files or enabling further attacks that compromise confidentiality, integrity, and availability of the system. Given the high CVSS score (8.1), the impact is considered high. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.