This vulnerability involves improper control of the filename parameter in PHP include/require statements within Mikado-Themes Wilmër (versions before 3.5). It allows PHP Local File Inclusion, which can be exploited by an attacker with low privileges to include unintended files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system by allowing an attacker to execute arbitrary code or access sensitive files. The vulnerability affects confidentiality, integrity, and availability of the application and underlying system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users should monitor Mikado-Themes vendor channels for updates and apply patches once released. Until a patch is available, restricting access to the vulnerable application and limiting privileges may reduce risk.