This vulnerability in Mikado-Themes Overton (<= 1.3) arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker could exploit this to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation can result in local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or disrupt service, impacting confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling or restricting the vulnerable functionality if possible and monitor official Mikado-Themes communications for updates.