Theme making direct ajax calls to theme folder
server setting that most likely responsible for restricting public access to the php files : Permission (try to set chmod 774 for the php file) .htaccess (try to add rewrite rule for that php file) maybe i’m wrong but it worth a try.