The Mikado‑Themes Fleur theme for WordPress contains an improper control of the filename used in PHP include/require statements, which allows an attacker to perform Local File Inclusion. This flaw, identified as CWE-98, can be leveraged to read arbitrary files from the server whenever a user‑supplied parameter is passed directly to an include or require function. An attacker could use this to view sensitive configuration files or other content that should remain hidden from the public web interface.

All installations of the Fleur theme version 2.0 or older are vulnerable. The issue is present in each release of the theme through version 2.0, and it may affect any site that currently enforces a Fleur theme. There are no partial patch releases documented, so any instance using a version equal to or less than 2.0 is at risk.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of fewer than 1 % indicates a very low observed exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation typically requires the attacker to supply a crafted query string or form input that triggers the include or require call, and from the exposed path an attacker can read files. Because the flaw is a local file inclusion, no direct remote code execution is possible unless the attacker can trigger execution of code that is included.