The vulnerability stems from improper control of filenames used in PHP include/require statements within the Mikado‑Themes Cocco WordPress theme. An attacker can manipulate input that is passed to these statements, causing the server to read or execute arbitrary local files. This can lead to information disclosure and, if the included content contains executable code, remote code execution or privilege escalation on the web host.

Affected products are all releases of the Mikado‑Themes Cocco WordPress theme with version numbers up to and including 1.5.1. No specific sub‑versions are listed; all builds from the earliest available version through 1.5.1 are vulnerable.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would target the theme via crafted requests that trigger the vulnerable include, potentially leveraging administrative or public access to the theme’s parameters. Inferred attack vector is local file inclusion through manipulated parameters or tampered file paths; further exploitation could achieve code execution if the attacker controls the local files included.