This vulnerability arises from an improper control of filenames in the Mikado–Themes Dør WordPress theme’s PHP include/require logic. An attacker can supply arbitrary local file paths, causing the server to read and access files it should not expose. Consequently, configuration files, credentials, or other sensitive data may be leaked, and if the attacker can provide a file that contains executable PHP code, the server might execute that code, leading to remote code execution—an effect inferred from the description. The weakness aligns with CWE‑98.

All installations of the Mikado–Themes Dør WordPress theme through version 2.4.1 are vulnerable, regardless of the WordPress core version, provided the theme’s code paths are active.

The CVSS score of 7.5 indicates substantial severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The attack vector likely involves a crafted request that bypasses file path restrictions inherent to the theme, but this is inferred from the available data. Given the flaw, an attacker who can influence the included file could compromise confidentiality and integrity, with potential remote code execution also inferred.