A high-severity local file inclusion vulnerability in the AncoraThemes Lettuce WordPress theme permits unauthenticated attackers to potentially read sensitive files or achieve remote code execution.

The vulnerability is a PHP Local File Inclusion (CWE-98) flaw that allows an unauthenticated attacker to manipulate input parameters to include arbitrary local files. The flaw resides in the theme's handling of include or require statements, which lacks sufficient validation of user-supplied filenames.

Successful exploitation of this vulnerability allows an attacker to read sensitive configuration files, source code, or other data hosted on the server, which can lead to full system compromise. With a CVSS score of 8.1, this represents a significant risk to data confidentiality and integrity. The ability to execute arbitrary PHP code through inclusion could result in complete site takeover and persistent backdoors.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the Lettuce theme if it is not business-critical, or monitor the vendor for the release of a security update that addresses this inclusion flaw.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing path traversal sequences or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and directory traversal attempts directed at the theme directory.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, administrators must treat this vulnerability with high urgency. If an update is not yet available from AncoraThemes, the most effective mitigation is to disable the affected theme entirely to prevent unauthorized file access until a verified fix is deployed.