The vulnerability is an improper control of filename in the include/require statement of the Wilmër theme, allowing local file inclusion. An attacker who can supply a crafted filename can cause the application to read or execute arbitrary files on the server, potentially leading to remote code execution, data exposure, or defacement. This weakness matches CWE‑98, which concerns improper handling of file names in include mechanisms.

The flaw exists in the Wilmër theme by Mikado‑Themes for all releases earlier than version 3.5 on WordPress installations. Sites using any pre‑3.5 theme version are vulnerable.

The CVSS score of 8.8 signals high severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but attackers possessing local or remote file upload capabilities could leverage this flaw to gain arbitrary code execution or read sensitive files. Successful exploitation grants the attacker the ability to compromise the integrity, confidentiality, or availability of the affected WordPress instance.