This vulnerability (CVE-2026-40731) in Mikado-Themes ChapterOne (<=1.7) is an unauthenticated Local File Inclusion (LFI) flaw caused by improper control of filenames used in PHP include/require statements, identified as CWE-98. The flaw allows remote attackers to include local files on the server, which can lead to execution of arbitrary code or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server running ChapterOne <=1.7. This can lead to full compromise of the system's confidentiality, integrity, and availability, including potential remote code execution and data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable installations, applying web application firewalls with rules targeting LFI attempts, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing vulnerable versions to untrusted networks.