A high-severity Local File Inclusion vulnerability in the AncoraThemes Exit Game WordPress theme poses a significant risk of unauthorized file access and potential system compromise.

The theme suffers from a PHP Local File Inclusion vulnerability, classified as CWE-98, which occurs due to insufficient sanitization of filenames passed to include or require statements. The CVSS vector indicates this is an unauthenticated vulnerability that can be triggered over the network without user interaction.

The ability to perform Local File Inclusion allows an attacker to read sensitive files from the underlying server, including configuration files, credentials, and source code. Given the CVSS score of 8.1, this vulnerability presents a high risk of total system impact, potentially leading to unauthorized data exposure and total loss of confidentiality, integrity, and availability of the affected WordPress instance.

Immediate Action: Since a specific patch is not currently identified, users should immediately deactivate or uninstall the Exit Game theme until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or attempts to access sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common file inclusion and directory traversal attack patterns to mitigate potential exploitation attempts.

Public Exploit Available: Unknown

The vulnerability represents a severe security flaw that could allow an attacker to read arbitrary files on the server. Because the vulnerability is unauthenticated and affects the core functionality of the theme, administrators must prioritize the removal of the vulnerable software or the application of vendor updates immediately upon availability.