The vulnerability arises from improper control of the filename used in PHP include/require statements within the Dolcino theme, allowing an attacker to specify arbitrary files for inclusion. When exploited, this can enable reading of arbitrary files from the server’s filesystem, and if that file contains PHP code it may lead to execution of attacker‑controlled code. The weakness is identified as CWE‑98.

The flaw exists in the Mikado‑Themes Dolcino WordPress theme for all releases from the earliest supported version up to and including version 1.6; no later releases contain this issue.

The CVSS base score of 8.1 indicates a high severity when the flaw is successfully leveraged. However, the EPSS score of less than 1% suggests the likelihood of active exploitation is low, and the vulnerability is not presently listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector involves a local file inclusion path discovered through the theme’s file handling logic, and successful exploitation would require the ability to control the filename parameter. Given these conditions, while the overall probability of exploitation remains low, the impact of correct exploitation is substantial.