The Harper theme for WordPress contains a flaw in the handling of filenames supplied to PHP include or require calls. By providing an arbitrary local filename, an attacker can cause the theme to include that file without sufficient validation. This local file inclusion can expose sensitive server files and, if the injected file contains executable PHP code, may lead to code execution. The vulnerability is identified as CWE-98 and exists in all releases of Harper up to version 1.13.

Any WordPress site running the axiomthemes Harper theme at version 1.13 or earlier is affected. The flaw is independent of specific WordPress core releases and impacts all installations where the theme is active.

The CVSS score of 8.1 marks the flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits are known. Based on the description, it is inferred that an attacker could target sites by manipulating the filename parameter used by the Harper theme, for example through crafted URLs or user input, and achieve local file inclusion that might lead to code execution if a PHP file is included.