The vulnerability originates from insufficient validation of file names in PHP include/require statements used by the Mikado‑Themes LuxeDrive theme. An attacker who can influence the filename parameter can force the theme to load arbitrary files from the WordPress server. When exploited, the attacker could read sensitive configuration files, user credentials, or any other local files, providing a foothold that could be leveraged for further compromise. The weakness aligns with CWE‑98, representing unvalidated input leading to unintended file inclusion.

All WordPress installations that have the Mikado‑Themes LuxeDrive theme version 1.0 or earlier are affected. The issue exists from the first release of the theme through the v1.0 version, and no newer stable releases have been announced.

The CVSS base score of 8.1 communicates a high severity, with potential confidentiality and integrity impacts. The EPSS score is below 1 %, indicating that large‑scale exploitation has not yet been observed, and the vulnerability does not appear in the CISA KEV catalog. Based on the description, the attack vector likely involves a crafted HTTP request to the theme’s file handling logic, enabling local file disclosure or execution if additional weaknesses are present.