The vulnerability occurs when the plugin fails to properly control the filename supplied to PHP's include/require functions, allowing an attacker to specify arbitrary local files for inclusion. This flaw, classified as CWE‑98, can expose sensitive data such as configuration files or, if the server permits execution of included code, lead to remote code execution. The impact is primarily a compromise of confidentiality and potential integrity or availability of the affected WordPress installation.

Mikado‑Themes Mikado Core plugin is affected for all releases from missing version information up through any release of version 1.6. Any WordPress site deploying Mikado Core version 1.6 or earlier is at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests that exploitation attempts are currently rare. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker supplies a malicious file path via the plugin’s interface or URL parameters to trigger inclusion. Exploitation requires the target server to permit inclusion of local files, a condition that may vary with configuration.