The KALLYAS WordPress theme contains a local file inclusion flaw in the TH_LatestPosts4 widget. Because the widget evaluates user‑supplied parameters and includes them without proper validation, an attacker who can authenticate with Contributor or higher privileges can include any .php file present on the server. This enables arbitrary PHP execution, which can be used to bypass the WordPress access controls, read sensitive files, or run malicious code. The vulnerability is a classic example of CWE-98.

All releases of the theme up to and including version 4.21.0 are affected. The theme is distributed by hogash as a multi‑purpose WordPress theme for eCommerce sites. The flaw therefore applies to any WordPress installation that has installed any of these vulnerable versions, regardless of the specific site content or configuration. Administrators should identify whether the site uses KALLYAS and verify the particular version number.

The CVSS score of 7.5 indicates a high severity with moderate‑to‑high impact. The EPSS score is less than 1%, suggesting that the probability of an exploitation carry on a given day is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw requires authenticated access, it is practical only for attackers who can gain Contributor or higher roles, but those roles are typically granted to trusted collaborators. If an attacker obtains such credentials, code execution can be achieved without further privilege escalation. The attack vector is Web‑based, leveraging the WordPress admin interface and the vulnerable widget.