The vulnerability is an improper control of filename in the include/require statement in the Mikado-Themes Depot WordPress theme. Because the supplied path is not properly validated, an attacker can include arbitrary files from the local filesystem through the PHP include mechanism. This flaw can lead to disclosure of sensitive files and, if attacker-controlled code is included, remote code execution within the context of the web application.

All installations of the Mikado-Themes Depot WordPress theme up to and including version 1.16 are affected. The vulnerability applies to any deployment that uses these theme versions on a WordPress site.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a very low exploitation probability at this point. The issue is not listed in the CISA KEV catalog. The likely attack vector is a local file inclusion that requires the attacker to be able to influence the filename supplied to the include statement, which typically implies having access to the site’s administrative interface or being able to provide crafted requests to the server.