The AncoraThemes Faith & Hope theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary local files on the server.

This flaw, categorized as CWE-98, involves improper control of filenames used in PHP include or require statements. An unauthenticated attacker can leverage this to perform Local File Inclusion, potentially accessing sensitive files or executing arbitrary code on the underlying host.

A successful exploit poses a critical risk to business operations, as it could lead to full system compromise, unauthorized access to sensitive configuration files, or the execution of malicious scripts. With a CVSS score of 8.1, the vulnerability is classified as High severity, reflecting the significant potential for confidentiality, integrity, and availability loss.

Immediate Action: Review the official Patchstack advisory for the latest security update and apply it immediately to the WordPress environment. If an official fix is not yet available for your specific installation, consider switching to an alternative, secure theme until a patch is released.

Proactive Monitoring: Monitor server access logs for suspicious file path patterns or attempts to include unexpected PHP files, particularly those originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common directory traversal and file inclusion attack signatures, which can mitigate the risk while a permanent patch is pending.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for full server compromise, administrators must prioritize the remediation of this vulnerability. Organizations should verify their current version of the Faith & Hope theme and apply the vendor update as soon as it becomes available to ensure the integrity and security of their web infrastructure.