An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Lymcoin theme poses a severe risk of unauthorized file access and potential code execution.

This flaw is a Local File Inclusion (CWE-98) occurring due to improper control of filenames in PHP include or require statements. It allows an unauthenticated remote attacker to include arbitrary local files on the server.

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, credentials, or other internal data residing on the web server. Given the CVSS score of 8.1, the potential for total compromise of the application environment is significant, which could result in severe reputational damage and unauthorized access to backend systems.

Immediate Action: Review the official Patchstack advisory for the Lymcoin theme and apply all available security updates or patches provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious patterns involving path traversal sequences, such as dot-dot-slash characters, targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal and file inclusion attack signatures.

Public Exploit Available: Unknown

The high CVSS severity highlights the critical nature of this flaw, as it allows unauthenticated interaction with the server file system. Administrators should prioritize upgrading the Lymcoin theme to the latest secure version immediately to eliminate the underlying vulnerability and prevent potential exploitation.