The vulnerability is a Local File Inclusion flaw that arises because the Wilmer theme does not properly validate file names used in PHP include/require statements. An attacker can supply a crafted file path, causing the server to read or execute files from the local file system. This defect can lead to disclosure of sensitive data, arbitrary PHP code execution, or compromise of the entire WordPress site. The weakness aligns with CWE‑98.

WordPress sites that use the Mikado‑Themes Wilmer theme are affected. Any installation employing a version older than 3.4.2, from the initial release through 3.4.1, is vulnerable to this LFI flaw.

With a CVSS score of 8.1, the issue is high severity. The EPSS score is below 1 %, indicating a low likelihood of widespread exploitation today, and it is not listed in the CISA KEV catalog. Nonetheless, the potential for remote code execution makes it a priority. The likely attack vector is a request that injects an arbitrary file path into a theme parameter or URL, leveraging the LFI mechanism.