A high-severity local file inclusion vulnerability in the CactusThemes VideoPro theme allows unauthenticated attackers to potentially read sensitive server files or execute arbitrary code.

This is a local file inclusion vulnerability (CWE-98) where an unauthenticated attacker can manipulate input parameters to include arbitrary files, leading to potential information disclosure or remote code execution.

Successful exploitation of this vulnerability could allow an attacker to read sensitive configuration files, including database credentials, or execute arbitrary PHP code on the underlying web server. With a CVSS score of 8.1, the risk of total system compromise is significant, potentially leading to unauthorized data access and full site takeover.

Immediate Action: Since a specific patch version is not currently identified, users should disable the VideoPro theme or restrict access to the affected site until CactusThemes releases a security update.

Proactive Monitoring: Monitor web server access logs for unusual patterns, such as path traversal sequences (e.g., ../) or requests targeting sensitive system files within URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block requests containing directory traversal characters or suspicious file inclusion attempts directed at the theme directory.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the potential for remote code execution, this vulnerability poses a severe threat to the integrity and confidentiality of the affected WordPress environment. Administrators must prioritize monitoring for signs of unauthorized file access and apply the vendor update immediately once it becomes available to remediate the underlying flaw.