The vulnerability in the Plan My Day WordPress theme is an improper control of the filename used in an include/require statement. By supplying a crafted input, an attacker can cause the theme to include an arbitrary local file. This can lead to reading sensitive files, or if the file contains PHP code, to executing attacker‑controlled instructions, thereby compromising the integrity and confidentiality of the site.

Axiomthemes’ Plan My Day WordPress theme is affected for all releases up to and including version 1.1.13. The issue occurs in any installation of the theme on WordPress.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. The most likely attack vector is via a crafted HTTP request that manipulates the theme’s filename parameter; the exploit does not require authentication as the theme code executes on every page load. Successful exploitation can expose local files or allow remote code execution if the attacker can supply PHP code.