This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within Mikado-Themes Marra, enabling an attacker to perform Local File Inclusion (LFI). This can allow unauthorized access to sensitive files, code execution, or other malicious actions depending on the context. The affected versions include all releases up to and including 1.2. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, but results in high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local file inclusion, potentially allowing an attacker to read sensitive files, execute arbitrary code, or disrupt service, severely impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 reflects this high impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests. Monitor vendor channels for updates and apply patches promptly once released.