A flaw in the Mikado-Themes Fiorello WordPress theme allows an attacker to supply an arbitrary filename to a PHP include/require statement. The lack of proper validation of that filename means the server may read or execute local files, enabling disclosure of sensitive information or execution of malicious PHP code. This vulnerability is classified as CWE-98.

WordPress sites that have installed the Fiorello theme version 1.0 or earlier are affected. No other vendors or products are impacted according to the CNA data.

The vulnerability is rated high severity with a CVSS score of 8.1. Current exploitation probability appears low (EPSS below 1%), and it is not listed in the CISA KEV catalog. Attackers would typically need the ability to influence a request that triggers the vulnerable include operation, such as an authenticated user modifying a URL parameter or an unauthenticated user manipulating data that reaches the theme code. Successful exploitation could compromise the entire WordPress site through local file access or code execution.