The Hara theme v1.2.17 contains an improper control of filename for include/require statements in PHP. This allows an attacker to trigger a local file inclusion by supplying a crafted path, potentially reading sensitive files or executing code. The vulnerability classification is CWE‑98. The CVSS score of 8.1 reflects a high‑severity bug that can compromise confidentiality and integrity of the WordPress instance.

WordPress sites using Thembay's Hara theme at versions 1.2.17 or earlier are affected. Users of the theme should immediately verify their installed version and plan an upgrade if the version is ≤ 1.2.17.

The EPSS score of less than 1 % indicates a low probability of exploitation today, but the high CVSS score and the nature of the flaw mean that exploitation could result in unauthorized file disclosure or code execution. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to supply a URL or form input that controls the file path; it is unclear whether the path is directory‑traversal restricted, so the attack vector is inferred as remote via crafted web requests.