An unauthenticated local file inclusion vulnerability in the AncoraThemes Gracioza theme allows attackers to read arbitrary files or execute malicious code on the host server.

This is a local file inclusion (CWE-98) vulnerability triggered by improper handling of user-supplied input in include or require statements. An unauthenticated attacker can manipulate these paths to include arbitrary files from the local filesystem.

The ability to include local files can lead to full system compromise, including the exposure of sensitive configuration files or the execution of arbitrary PHP code. Given the CVSS score of 8.1, this is a high-severity flaw that poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation may result in unauthorized access to database credentials and complete site takeover.

Immediate Action: Check the vendor website for security updates and apply them immediately. If no official patch is available, consider switching to an alternative theme until the vulnerability is addressed.

Proactive Monitoring: Monitor server access logs for unusual file path requests, such as those containing directory traversal sequences like double dots or references to system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and file inclusion attempts targeting PHP applications.

Public Exploit Available: Unknown.

This vulnerability represents a critical security gap that could allow an attacker to bypass standard authentication and gain control over the web server. Administrators should prioritize identifying instances of the Gracioza theme within their environment and restrict access to the affected components until a verified vendor patch is applied.