The AncoraThemes Monyxi theme is vulnerable to local file inclusion, which could allow an unauthenticated attacker to execute arbitrary PHP code or access sensitive files on the server.

The vulnerability is a PHP Local File Inclusion (CWE-98) occurring because the application fails to properly sanitize user input before using it in an include or require statement. This flaw is exploitable by unauthenticated attackers over the network.

A successful exploit allows an attacker to read arbitrary files from the server, potentially exposing configuration files, credentials, or source code. Furthermore, if the attacker can influence the content of the included file, they may achieve remote code execution, leading to a complete compromise of the WordPress installation and the underlying server. With a CVSS score of 8.1, this is a High severity issue that requires immediate attention to prevent unauthorized access and data breaches.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or contact AncoraThemes for the latest security update.

Proactive Monitoring: Monitor server access logs for requests containing path traversal sequences or attempts to include unexpected file types, such as .php, .txt, or .log files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns targeting the theme directory.

Public Exploit Available: Unknown.

Given the potential for remote code execution and the lack of a verified patch, users should treat this vulnerability with high urgency. If an official update is not available from the vendor, the most effective mitigation is to deactivate and remove the Monyxi theme until the developer provides a secure version. Regular backups and strict filesystem permissions should be maintained as a baseline defense against this and similar file inclusion threats.