This vulnerability (CVE-2026-40731) affects Mikado-Themes ChapterOne PHP software versions up to 1.7. It is classified under CWE-98, indicating improper control of filenames in include/require statements, which can lead to remote file inclusion. The flaw allows unauthenticated attackers to exploit local file inclusion, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.1, reflecting a high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor-provided patch or remediation guidance available yet, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can allow unauthenticated remote attackers to include and execute arbitrary local files on the server running ChapterOne, leading to full compromise of the system's confidentiality, integrity, and availability. This can result in unauthorized code execution, data disclosure, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and consider applying temporary mitigations such as disabling vulnerable functionality or restricting file inclusion paths if possible.