The AncoraThemes Gardis WordPress theme contains a critical local file inclusion vulnerability that permits unauthenticated attackers to access or execute arbitrary files on the host server.

This flaw is classified as a Local File Inclusion (CWE-98) occurring due to improper control of filenames in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform local file inclusion poses a severe risk to organizational security, as it can lead to full server compromise, the exposure of sensitive configuration files, or remote code execution. With a CVSS score of 8.1, this vulnerability is categorized as High, representing a significant threat to data integrity, confidentiality, and overall system availability.

Immediate Action: Users should immediately deactivate or remove the affected Gardis theme until a security update is released and verified by the vendor.

Proactive Monitoring: Security teams should audit web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths targeting PHP includes.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common file inclusion and directory traversal payloads to reduce the attack surface.

Public Exploit Available: Unknown

Given the severity of potential file inclusion attacks, administrators must treat this vulnerability with high priority. Since no patch is currently confirmed, immediate deactivation of the Gardis theme is the only effective way to eliminate the risk of unauthorized file access and potential code execution.