CVE-2026-39537 is a CWE-98 Improper Control of Filename for Include/Require Statement vulnerability in Mikado-Themes Mikado Core. It allows unauthenticated attackers to perform local file inclusion (LFI) on Mikado Core versions up to 1.6. This flaw arises from insufficient validation or sanitization of file paths used in PHP include or require statements, enabling attackers to include arbitrary local files. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Since the vulnerability is unauthenticated, it can be exploited remotely without credentials. The high CVSS score reflects the critical nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Mikado-Themes advisories for updates and apply patches promptly once available. Until then, restricting access to vulnerable endpoints and employing web application firewalls may help reduce exposure.