A critical local file inclusion vulnerability in the axiomthemes Fabric theme allows unauthenticated attackers to potentially read sensitive files or achieve remote code execution.

This vulnerability, categorized as CWE-98, arises from insecure handling of filenames in PHP include or require statements. An unauthenticated attacker can manipulate input parameters to include arbitrary local files on the server.

Successful exploitation of this flaw can result in the exposure of sensitive configuration files, database credentials, or source code. With a CVSS score of 8.2, this high-severity vulnerability poses a significant risk of full system compromise, data theft, and potential unauthorized execution of malicious code, which could lead to severe operational disruption and reputational damage.

Immediate Action: Review the official Patchstack advisory for the availability of a security update and apply it immediately to version 1.5.0 or later. If no patch is available, consider switching to an alternative theme until a vendor-supplied fix is released.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal patterns or unexpected file paths in URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns.

Public Exploit Available: Unknown.

Given the potential for high-impact compromise, administrators should prioritize the remediation of this vulnerability. Organizations using the Fabric theme must check the vendor documentation for updates and apply them as soon as they are made available to prevent unauthorized access to the underlying server environment.