The Mikado-Themes TopScorer Sports WordPress Theme up to version 1.2 contains a vulnerability due to improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary code execution or disclosure of sensitive files. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official fix information is available from the vendor or advisory sources at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the web server, potentially leading to remote code execution, data disclosure, and full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor vendor channels for updates and apply patches promptly once available.