An improper control of the filename for the PHP include/require construct in the Mikado‑Themes MultiOffice theme allows an attacker to retrieve arbitrary files from the server. By manipulating the path value, a malicious user could read sensitive files such as configuration files, credentials, or source code. If a writable file is accessible, the attacker could inject PHP code that may be executed on the server, giving full control over the site. The weakness is a classic PHP Local File Inclusion scenario, aligned with CWE‑98. The resultant loss of confidentiality, integrity, and potentially availability follows the typical LFI chain, which may lead to complete compromise of the WordPress installation.

WordPress sites that use the Mikado‑Themes MultiOffice theme version 1.2 or earlier are affected. No other vendors or products are listed as vulnerable.

The CVSS score of 8.1 classifies the issue as high severity. The EPSS score indicates a low probability of exploitation in the short term, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an attacker can supply a crafted request to the theme on a publicly accessible WordPress site to trigger the include/require with a controlled filename. No additional conditions are specified, so the vulnerability appears exploitable with minimal effort on a properly exposed site.