This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the Mikado-Themes Curly Core plugin. It allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files, code execution, or denial of service. The affected versions include all versions up to and including 2.1.6. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected systems running vulnerable versions of Curly Core. Given the high CVSS score and impact metrics, this vulnerability poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Curly Core plugin or applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates.