This vulnerability in Mikado-Themes Verdure arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion (LFI). An attacker could exploit this to execute arbitrary code or access sensitive files on the server. The issue affects Verdure versions up to and including 1.6. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting vulnerable functionality and apply best practices for PHP security such as disabling allow_url_include and restricting file permissions. Monitor vendor channels for updates.