This vulnerability in Mikado-Themes Hendon arises from insufficient validation of filenames used in PHP include/require statements, enabling Local File Inclusion (LFI). The affected versions are all prior to 1.7. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require parameters, and reviewing application code for unsafe file inclusion practices.