This vulnerability is an improper control of filename in a PHP include/require statement that allows local file inclusion. It can enable an attacker to read arbitrary files from the server, potentially exposing sensitive configuration, authentication credentials, or other confidential data. The weakness is identified as CWE‑98. While the description does not explicitly mention code execution, LFI can often be leveraged for Remote File Inclusion if the server allows fetching remote files, thereby risking further compromise. The CVSS score of 8.1 indicates a high severity impact.

The Mikado Themes Wanderland WordPress theme is affected for all releases up to and including version 1.5. Any site using these versions is susceptible, regardless of other WordPress versions or plugins. No other products or vendors are listed as impacted.

The CVSS rating classifies the issue as high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion through a crafted request that manipulates a file path used by the theme during a PHP include operation. Exploitation requires either an exposed vulnerable endpoint or an ability to influence the file path parameter used by the theme.