This vulnerability in Mikado-Themes Depot arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all up to and including 1.16. The vulnerability allows an unauthenticated remote attacker to cause the application to include local files, which can lead to arbitrary code execution and compromise of the system. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.

Successful exploitation can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code on the affected system. This can result in full system compromise, data leakage, and denial of service. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application and consider disabling or limiting functionality that involves dynamic file inclusion. Monitor Mikado-Themes advisories for updates and apply patches promptly once available.