The Urna theme for WordPress has a flaw where filenames supplied to PHP include/require are not properly sanitized, allowing an attacker to load arbitrary local files. This Local File Inclusion vulnerability falls under CWE-98 and can enable reading sensitive system files or executing attacker‑supplied code, leading to full remote code execution on the web server.

Any WordPress installation using the Urna theme version 2.5.12 or earlier is affected. The vulnerability applies to all releases from the earliest available down to 2.5.12, including unknown earlier versions that the vendor has not explicitly disavowed.

The CVSS score of 7.5 classifies this as a high‑severity issue, while the EPSS score of less than 1% indicates a currently low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation. An attacker can typically exploit the flaw by crafting a request that supplies an arbitrary file path to the theme’s include logic, often via a URL parameter or a theme option, without needing authentication. Successful exploitation could lead to code execution or disclosure of local files.