A high-severity Local File Inclusion vulnerability in the AncoraThemes GlamChic WordPress theme allows unauthenticated attackers to compromise sensitive system information.

The theme fails to properly sanitize filenames used in PHP include or require statements. This allows an unauthenticated attacker to supply malicious input to trigger Local File Inclusion, potentially leading to the disclosure of sensitive server files or execution of arbitrary local code.

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the WordPress environment. Given the CVSS score of 8.1, the potential for unauthorized file access and remote code execution could lead to full system compromise, data exfiltration, and severe operational downtime.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate the GlamChic theme until the vendor releases a security update. If the theme must remain active, ensure that all directory traversal attempts are blocked at the server level.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences or attempts to access configuration files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious include path parameters or directory traversal characters (e.g., ../) directed at the theme files.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the high CVSS severity and the potential for total system impact, this vulnerability must be addressed with urgency. Organizations using the GlamChic theme should verify their version immediately and apply the vendor's security guidance as soon as it becomes available to prevent unauthorized access.