The NasaTheme Elessi theme is vulnerable to local file inclusion, which could allow an authenticated attacker to compromise system files and achieve full application impact.

This vulnerability, classified as CWE-98, involves improper control of filenames during PHP include operations. An attacker with low-level privileges can manipulate input to include local files, potentially leading to unauthorized data access or code execution.

The exploitation of this vulnerability allows for local file inclusion, which poses a severe risk to the confidentiality, integrity, and availability of the host environment. With a CVSS score of 7.5, this high-severity flaw could lead to the exposure of sensitive configuration files or credentials, potentially resulting in full system compromise and significant reputational damage.

Immediate Action: Update the NasaTheme Elessi theme to version 6.4.1 or higher immediately to resolve the vulnerable include logic.

Proactive Monitoring: Review server access logs for suspicious file path patterns or attempts to access non-public PHP files within the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal or file inclusion attempts directed at the WordPress theme directory.

Public Exploit Available: Unknown.

Given the high impact of local file inclusion vulnerabilities, organizations utilizing the Elessi theme must prioritize this update. Administrators should verify their current version and apply the patch provided by the vendor to eliminate the risk of file system traversal and unauthorized access.