This vulnerability in Mikado-Themes HealthFirst arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to execute arbitrary local files on the affected system, potentially compromising the server. The issue affects versions up to and including 1.0.1. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary local files on the server running HealthFirst, compromising confidentiality, integrity, and availability of the system. This could allow attackers to read sensitive files, execute malicious code, or disrupt service. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable include/require functionality if possible and monitor for updates from Mikado-Themes. No official patch or workaround is currently documented.