Improper control of file names in PHP include/require statements enables a local file inclusion flaw. A site that uses the Mikado‑Themes Wellspring theme is able to read arbitrary local files and potentially execute code supplied through those files. The defect receives a CVSS score of 8.1, reflecting substantial confidentiality and integrity risks should an attacker leverage it.

The vulnerability affects the Mikado‑Themes Wellspring WordPress theme in all releases prior to version 2.8. The description indicates the issue exists from the initial release through any version lower than 2.8, so any site still using a pre‑2.8 version is potentially exposed.

The EPSS score is listed as less than 1 %, suggesting rare exploitation at present, and the vulnerability is not in the CISA KEV catalog. Attacks would likely originate from a remote web user exploiting the theme’s file inclusion logic, though a local attacker could also gain advantage depending on server configuration. Because the flaw hinges on unvalidated file paths, the risk remains significant until the theme is updated or mitigated.