A critical local file inclusion vulnerability in the axiomthemes Prisma theme for WordPress allows unauthenticated attackers to potentially read sensitive system files.

The vulnerability, classified as CWE-98, involves improper control of filenames in PHP include statements. This flaw enables an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data access or code execution.

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, database credentials, or other critical internal data stored on the web server. Given the CVSS score of 8.2, this represents a high-risk security gap that could result in full system compromise and significant reputational damage to the organization.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or disable the Prisma theme until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences, such as "../", directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and path traversal attempts targeting PHP applications.

Public Exploit Available: Unknown.

The severity of this local file inclusion vulnerability necessitates immediate action to protect the integrity and confidentiality of the affected web server. Organizations using the Prisma theme must prioritize moving to a supported, patched version once available or removing the vulnerable component entirely to eliminate the attack surface.