A critical Local File Inclusion vulnerability in the axiomthemes Pantry theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

This vulnerability is classified as CWE-98, involving improper control of filenames in PHP include or require statements. The flaw permits an unauthenticated attacker to perform Local File Inclusion, which can lead to unauthorized file access or code execution.

The ability to include arbitrary local files poses a severe risk to the confidentiality, integrity, and availability of the WordPress environment. An attacker could leverage this flaw to read configuration files, such as wp-config.php, or execute malicious code, leading to full site compromise. With a CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent data theft or service disruption.

Immediate Action: Since no patch is currently confirmed, administrators should immediately deactivate or uninstall the Pantry theme if it is not strictly required for site operations.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing directory traversal sequences or attempts to access system files like etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts to minimize the attack surface.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for full system compromise, organizations currently using the axiomthemes Pantry theme must treat this vulnerability with high urgency. If an update from the vendor becomes available, it should be applied immediately after testing. In the absence of a patch, removing the vulnerable software is the only reliable method to eliminate this risk.