Improper control of filename for Include/Require Statement in PHP allows user‑controlled file paths to be processed in the Mikado‑Themes Justicia theme. An attacker that can supply an arbitrary include path could read local files or upload a malicious PHP script and include it, effectively executing arbitrary code on the site. The weakness is classified as CWE‑98.

The affected product is the WordPress theme "Justicia" from the vendor Mikado‑Themes. All releases from the first version up through 1.2 contain the vulnerable code, and no fixed version is currently cited, indicating that any installation running 1.2 or earlier remains exposed.

The vulnerability has a high CVSS score of 8.1, yet its EPSS score is below 1%, suggesting few observed exploit attempts. It is not listed in the CISA KEV catalog. The attack likely requires a crafted input to the theme’s include logic, which may be a publicly accessible parameter. Because the flaw allows file inclusion without validation, exploitation could lead to reading sensitive files or arbitrary code execution, although the low EPSS indicates current exploitation risk is modest.