This vulnerability in Mikado-Themes MultiOffice arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion (LFI). This can allow an attacker to include and execute arbitrary files on the server, potentially leading to remote code execution or data disclosure. The issue affects MultiOffice versions up to and including 1.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to vulnerable installations and consider disabling or restricting the affected functionality if possible. Monitor Mikado-Themes advisories for updates regarding patches or mitigations.