An unauthenticated local file inclusion vulnerability in the AncoraThemes Strux theme poses a significant risk of full system compromise via arbitrary file access or execution.

This vulnerability, categorized as CWE-98, stems from improper control of filenames used in PHP include or require statements, which allows an unauthenticated attacker to perform local file inclusion.

The ability to include arbitrary local files enables an attacker to read sensitive configuration files, such as database credentials, or execute malicious code on the server. Given the CVSS score of 8.1, this flaw presents a high risk to confidentiality, integrity, and availability, potentially leading to a complete takeover of the WordPress instance and lateral movement within the hosting environment.

Immediate Action: Since no official patch is currently confirmed, users should immediately deactivate or remove the Strux theme if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the theme directory.

Public Exploit Available: Unknown.

The vulnerability in the AncoraThemes Strux theme is severe and warrants immediate attention. Administrators must prioritize identifying all instances of the affected software and implementing the recommended compensating controls or removal strategies until an official vendor update is verified and applied.