This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the Mikado-Themes Biagiotti theme. It allows an attacker to perform Local File Inclusion, potentially leading to arbitrary code execution or disclosure of sensitive files. The issue affects all versions prior to 3.5.2. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive information, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the severity of these impacts. However, no known exploits have been reported in the wild at this time.

No official patch or vendor advisory is currently available. Users should monitor the Mikado-Themes vendor channels for updates and apply any official fixes once released. Until then, restricting access to vulnerable endpoints and disabling or removing the affected theme version may reduce risk. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.