The Planty WordPress theme contains an unauthenticated local file inclusion flaw that allows an attacker to include arbitrary files present on the server via the web interface. This weakness, classified as CWE‑98, can be used to read sensitive files, execute PHP code on the server, or potentially gain full control of the site if the attacker can upload malicious content. The impact is a local compromise of the hosting environment and a loss of confidentiality, integrity, and availability for users of the affected site.

The vulnerability affects the WordPress Planty theme by ThemeREX for all releases up to and including version 1.14.0. Site administrators using these versions on any WordPress installation are at risk.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests that the likelihood of this vulnerability being exploited in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog, indicating that it has not yet been reported as a known exploited vulnerability. The most probable attack vector is via the web interface of a publicly accessible WordPress site, requiring no authentication but relying on the presence of the vulnerable theme.