An unauthenticated attacker who can send HTTP GET requests to the download.php endpoint can supply a file:// URI in the calendar parameter, causing the server to read and return the contents of arbitrary local files. The vulnerability can expose sensitive data such as /etc/passwd or other configuration files, representing a significant confidentiality breach. The weakness is a directory traversal / path manipulation flaw (CWE-22) that does not require authentication and can be triggered from any network location that can reach the web server.

The affected product is the WooThemes Diarise WordPress theme, version 1.5.9, which is delivered through the WooThemes vendor. This version implements a download.php script that accepts a calendar query parameter and does not validate or restrict the file paths it opens.

The CVSS score of 8.7 classifies the issue as high impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on unauthenticated HTTP requests, and proof of exploitation was observed on 2023‑10‑19 by the Shadowserver Foundation. Because any user can read arbitrary files from the server, the practical exposure is considerable, especially for sensitive system files.