The Rhythmo theme permits an unvalidated filename to be passed to a PHP include/require call, allowing an unauthenticated attacker to read arbitrary files on the server. The weakness is identified as CWE‑98, exposing the site to potential leakage of sensitive configuration or other data. The impact is a compromise of confidentiality for the files that the web server can reach.

All installations of the WordPress Rhythmo theme version 1.3.4 and earlier are affected. WordPress sites using those theme releases are vulnerable until the theme is updated to a patched release equal to or newer than 1.3.5.

The CVSS score of 8.1 classifies the flaw as high severity, while an EPSS score of less than 1% suggests that exploitation incidents are rare at this time. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to send a crafted request that triggers the theme’s inclusion logic, enabling the reading of local files without authentication or code execution privileges.