This vulnerability in zozothemes Miion (<= 1.2.7) arises from improper control of filenames in PHP include/require statements, resulting in a Local File Inclusion (LFI) flaw. The CVSS 3.1 score of 7.5 indicates a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. The issue allows an attacker to include local files on the server, potentially exposing sensitive information or enabling further attacks. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability. The attacker requires network access and low privileges but no user interaction. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying general PHP security best practices relevant to file inclusion vulnerabilities. Monitor vendor channels for updates.