WordPress Hara theme versions up to 1.2.10 contain a flaw where a filename supplied by the user is directly passed to a PHP include/require statement, which allows local file inclusion. The vulnerability is classified as CWE‑98 and can let an attacker read arbitrary files on the hosting server or, if the server permits execution of the included file, run malicious PHP code. The description indicates that the problem stems from improper control of the filename for include/require, but the exact input vector is not explicitly detailed, so it is inferred that user‑supplied parameters to the theme are involved.

The issue affects any WordPress installation that uses the Thembay Hara theme version 1.2.10 or earlier. All sites that have not yet upgraded beyond these releases are potentially vulnerable.

The CVSS score of 8.1 reflects a high severity. The EPSS score is reported as less than 1 %, suggesting that active exploitation is rare as of this assessment. The vulnerability is not listed in the CISA KEV catalog. Although the exact attack vector is not specified, it is likely that an unauthenticated user supplying crafted input to the theme could trigger the flaw, so the risk remains significant for sites still running the affected version.