The Mikado-Themes Fleur WordPress theme versions up to 2.0 contain a vulnerability due to improper control of filenames in PHP include or require statements. This weakness allows PHP Local File Inclusion, enabling an attacker to include arbitrary files from the server. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack vector is network-based with high attack complexity and no privileges or user interaction required. No vendor patch or advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability of affected systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme or applying manual code review and hardening to prevent inclusion of untrusted files. Monitor vendor channels for updates and patches.