High · published December 9, 2025
⚡ A sneaky local file inclusion vulnerability lurks in Mikado-Themes Wilmër, allowing attackers to include unexpected files! 🔥 Think of it like a restaurant recipe book that lets a chef add any ingredient they want, even if it’s a spoiled item from the back of the fridge. It’s a recipe for disaster when the wrong file gets included! With this issue, an attacker could potentially include malicious files, executing unauthorized code on your server. The consequences could be absolutely devastating—data leaks, site defacement, or even full control over your server, putting your users at risk!
Think of it like a restaurant recipe book that lets a chef add any ingredient they want, even if it’s a spoiled item from the back of the fridge. It’s a recipe for disaster when the wrong file gets included! The vulnerability stems from improper control of filenames for include or require statements in PHP, allowing attackers to manipulate file paths and include files from unintended locations from the server.
With this issue, an attacker could potentially include malicious files, executing unauthorized code on your server. The consequences could be absolutely devastating—data leaks, site defacement, or even full control over your server, putting your users at risk! To mitigate this, immediately update to Wilmër version 3.5 or higher. Implement strict validation of file paths, and consider disabling file inclusion features if they're not needed. Don't wait to safeguard your site! You’ve got this! Follow these steps, and you’ll have your security tightened up in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| qodeinteractive/wilmer | < 3.5 | 3.5 |