This vulnerability in Mikado-Themes Dolcino arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions include all up to and including 1.6. The CVSS 3.1 score of 8.1 reflects network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to include local files on the server, potentially exposing sensitive information, executing arbitrary code, or disrupting service. The high CVSS score indicates a serious risk to system confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor Mikado-Themes communications for updates. Applying general PHP security best practices, such as disabling dangerous PHP functions and restricting file permissions, may reduce risk but are not specific mitigations for this vulnerability.