This vulnerability in Mikado-Themes HealthFirst theme arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. The issue affects all versions up to 1.0.1. Exploitation could allow attackers to include local files on the server, potentially exposing sensitive data or enabling further attacks. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently documented.

Successful exploitation of this vulnerability could lead to disclosure of sensitive files on the server, unauthorized code execution, and disruption of service. The high CVSS score indicates that confidentiality, integrity, and availability of the affected system are all at risk. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable HealthFirst theme version (<=1.0.1) to prevent exploitation. Restricting access to the affected system and monitoring for suspicious activity may also help reduce risk.