Improper control of file names used in PHP include/require statements inside the Mikado‑Themes Foton theme allows an attacker to trigger local file inclusion. This flaw can let a caller read arbitrary files from the web server’s filesystem, potentially exposing sensitive configuration data, source code, or other private files. The issue is labeled as CWE‑98 and can be leveraged in a web‑based attack context, resulting in confidentiality compromise.

The vulnerability applies to the Mikado‑Themes Foton WordPress theme for all releases up to and including version 2.5.2. Any WordPress site that has the theme installed and has not upgraded beyond this version is affected.

The CVSS score of 8.1 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation at present, and the vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog. The likely attack vector involves web requests that provide a crafted filename parameter to the theme’s include path, enabling the attacker to read local files from the server. Because the flaw is local file inclusion rather than remote code execution, successful exploitation depends on the ability to direct the theme to read files that contain exploitable data or configuration.