The Evently theme implements an include/require mechanism that does not properly control the filename supplied by the user. An attacker combining a crafted request can force the theme to read or execute arbitrary files from the local filesystem, exposing sensitive data or enabling arbitrary code execution. The flaw aligns with the PHP Remote File Inclusion weakness identified by CWE-98 and can compromise confidentiality, integrity, and availability of the affected site.

The attack surfaces all installations of the Mikado‑Themes Evently theme up to and including version 1.7. No version beyond 1.7 is known to be vulnerable; older or newer releases may or may not be impacted.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Its EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, local file inclusion can be triggered through a simple HTTP request, making the attack path straightforward for a threat actor who can send crafted URLs.