The CocoBasic Blanka WordPress theme contains a critical path traversal vulnerability that allows unauthenticated attackers to perform local file inclusion, potentially leading to full system compromise.

This vulnerability is a path traversal flaw (CWE-35) triggered by improper input validation of file paths. Unauthenticated attackers can exploit this to perform local file inclusion, which may allow for the reading of sensitive server files or the execution of arbitrary code.

The ability for an unauthenticated user to perform local file inclusion presents a severe risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.2, this vulnerability is classified as High and could allow an attacker to gain unauthorized access to configuration files or sensitive application data, leading to a complete compromise of the WordPress environment.

Immediate Action: Update the CocoBasic Blanka theme to version 1.5 or later, as this version contains the necessary security fixes to remediate the path traversal flaw.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as multiple dot-dot-slash patterns, directed toward the theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unauthorized file inclusion requests.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for unauthorized local file access, administrators should prioritize updating the Blanka theme immediately. If an update cannot be applied right away, verify that the site is protected by a WAF and restrict file system permissions to the minimum necessary for the web server user to operate.