This vulnerability in Mikado-Themes Malgré (<= 1.0.3) arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker could exploit this to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to read or execute arbitrary files on the affected server, compromising confidentiality, integrity, and availability of the system. Given the high CVSS score (8.1), the impact is considered severe. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected application, apply web application firewall rules to detect and block suspicious include/require requests, and avoid exposing the application to untrusted inputs that could influence file inclusion.