This vulnerability in Mikado-Themes Mikado Core (versions up to 1.6) arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. LFI vulnerabilities can allow attackers to read sensitive files on the server or execute arbitrary code depending on the context. The issue is documented as CVE-2026-39538 with no CVSS score or vendor remediation information available. The product is not a cloud service, and no patch links or advisories have been published.

The vulnerability allows an attacker to perform Local File Inclusion, which can lead to unauthorized disclosure of sensitive files or potentially remote code execution if combined with other vulnerabilities. However, no known exploits have been reported in the wild, and the exact impact depends on the server configuration and usage of the vulnerable Mikado Core versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions and applying general PHP security best practices to limit exposure. Monitor vendor channels for updates or patches addressing this vulnerability.