A local file inclusion vulnerability in the xtemos WoodMart theme allows authenticated attackers to execute arbitrary local files, posing a significant risk to site integrity and data confidentiality.

This flaw is classified as a Local File Inclusion (CWE-98) issue, occurring because the theme does not properly sanitize filenames used in PHP include or require statements. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack is network-accessible, it requires a low-privileged authenticated user to trigger the flaw.

Successful exploitation allows an attacker to include and potentially execute arbitrary PHP files on the server, leading to full site compromise. Given the CVSS score of 7.4, this vulnerability represents a high risk, as it could facilitate unauthorized access to sensitive configuration files, database credentials, or remote code execution.

Immediate Action: Review the official xtemos website for security updates and upgrade the WoodMart theme to the latest version beyond 8.3.2 immediately.

Proactive Monitoring: Monitor server access logs for unusual file path patterns or attempts to access system files, such as wp-config.php, through theme-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and suspicious file inclusion patterns in HTTP requests.

Public Exploit Available: Unknown.

Administrators must prioritize updating the WoodMart theme to a version that addresses this inclusion flaw. Because this vulnerability grants attackers the ability to read sensitive server-side files or execute code, prompt remediation is essential to maintain the security posture of the WordPress environment.