The Hara theme for WordPress fails to properly validate the filename supplied to PHP include/require statements. This flaw allows an attacker to craft a path that resolves to any file on the server, leading to local file inclusion. By including sensitive files such as configuration files or credentials, an attacker can gain confidential information and, if the included file contains executable PHP code, potentially gain code execution on the site.

Any WordPress installation using the Hara theme version 1.2.17 or earlier is affected. The vulnerability exists in all releases from the earliest available version up to and including 1.2.17.

The CVSS score of 7.5 classifies the vulnerability as high severity, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would typically occur via a web request that supplies a crafted path to the vulnerable include/require call, allowing the attacker to read or execute arbitrary local files.