The vulnerability arises from improper control of filenames in PHP include/require statements, classified as CWE‑98, that permits an attacker to include arbitrary local files while the Dør theme processes requests. If the attacker can influence the path, they may read sensitive configuration files or execute injected PHP code, leading to information disclosure or remote code execution.

The Mikado‑Themes WordPress theme Dør, versions n/a through 2.4, is affected. This includes every WordPress installation that has any of those versions installed, whether the theme is currently active or not.

With a CVSS score of 8.1, the vulnerability represents high severity. The EPSS score of less than 1% indicates a low current exploitation likelihood, and it is not listed in CISA’s KEV catalog. Likely exploitation requires sending crafted HTTP requests to the site that trigger the vulnerable include. Depending on server configuration, success could give an attacker access to local files or the ability to run arbitrary code in the web‐server context.