An improper control of the filename in the Mikado‑Themes Hendon theme allows an attacker to include local files via a PHP include/require statement. This Local File Inclusion flaw can expose sensitive files on the server and, if an attacker can write files, may lead to arbitrary code execution on the web host.

WordPress sites that install the Hendon theme version earlier than 1.7 are vulnerable. The affected product is the Hendon theme supplied by Mikado‑Themes for WordPress environments.

The CVSS score of 8.1 classifies the issue as high severity, and the EPSS score of less than 1% indicates a very low probability of exploitation based on current threat data. The vulnerability is listed in CISA’s KEV catalog as not listed, meaning it has not yet been observed as a widely exploited vulnerability. The likely attack vector is an attacker submitting crafted input through the web interface to manipulate the filename used in the include/require call, enabling them to read or execute local files on the server.