This vulnerability is an unauthenticated local file inclusion (LFI) issue in Mikado-Themes Foton Core software versions up to 1.1.1. It arises from improper control of filenames in PHP include/require statements, allowing attackers to include and execute arbitrary files on the server. The CVSS 3.1 base score is 8.1, indicating high impact with network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No patch or official remediation information is currently available.

Successful exploitation can lead to full compromise of the affected system, including arbitrary code execution, data disclosure, and denial of service. The vulnerability is exploitable remotely without authentication, but requires high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor advisory or patch links are currently available.