A critical Local File Inclusion vulnerability in the AncoraThemes Kings & Queens theme exposes the server to unauthorized file access and potential system compromise.

This flaw is classified as CWE-98, representing improper control of filenames in PHP include statements. An unauthenticated attacker can leverage this to perform Local File Inclusion (LFI), potentially reading sensitive configuration files or executing arbitrary code on the underlying server.

The vulnerability carries a CVSS score of 8.1, indicating a high risk of total system compromise, including unauthorized data exposure, integrity loss, and availability disruption. Successful exploitation allows an attacker to bypass standard application access controls to interact with sensitive server-side files, leading to significant reputational damage and potential regulatory non-compliance regarding data privacy.

Immediate Action: As no specific patch version is currently identified, administrators should immediately disable the Kings & Queens theme or switch to an alternative theme until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or references to sensitive files like etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized file inclusion attempts targeting the theme directory.

Public Exploit Available: No (Exploit status is unknown; no confirmed public weaponized exploit or PoC exists in the analyzed data).

Given the high CVSS severity and the potential for full system compromise via Local File Inclusion, this vulnerability poses a significant threat to organizational security. IT administrators must treat this as a high-priority incident, ensuring the affected theme is removed or restricted until the vendor provides a verified security update. Continuous monitoring of web logs remains essential to detect any early signs of probing or exploitation.