A high-severity local file inclusion vulnerability in the ThemeMove Unicamp theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's PHP include/require logic. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N/UI:N.

Successful exploitation of this vulnerability allows an attacker to include arbitrary local files on the server, which can lead to the exposure of sensitive configuration files or the execution of malicious code. Given the CVSS score of 8.1, the potential for total impact on confidentiality, integrity, and availability poses a significant risk to the security of the hosting environment and the integrity of the application data.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Unicamp theme or switch to a secure alternative until a vendor update is released.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal sequences or attempts to include unusual PHP files from the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting the theme path.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the high CVSS score and the nature of local file inclusion vulnerabilities, the risk of unauthorized system access is significant. It is imperative that organizations running the Unicamp theme prioritize the immediate removal or containment of the affected software until the vendor provides a verified security patch.