The axiomthemes EcoGrow WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to read sensitive files or execute arbitrary code on the server.

This vulnerability is a Local File Inclusion (CWE-98) flaw that occurs when user-supplied input is improperly sanitized before being passed to a PHP include or require function. An unauthenticated attacker can exploit this to include arbitrary files from the server filesystem.

A successful exploit of this vulnerability could lead to the exposure of sensitive configuration files, database credentials, or other proprietary system data. Given the CVSS score of 8.2, the risk is high as it facilitates unauthorized access to the application environment, potentially resulting in full system compromise and significant reputational damage.

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately deactivate or uninstall the EcoGrow theme if it is not business-critical. If the theme must remain active, ensure strict file permissions and restrict access to the web server directory.

Proactive Monitoring: Monitor server access logs for suspicious patterns involving directory traversal sequences (such as ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block Local File Inclusion attempts and path traversal signatures.

Public Exploit Available: Unknown.

The high severity of this vulnerability necessitates immediate attention from security teams managing WordPress environments. Because the issue allows an unauthenticated actor to interact with the underlying filesystem, the risk to confidentiality and integrity is substantial. Until the vendor releases a secure version, prioritize the isolation of affected systems and the implementation of robust WAF protections to prevent exploitation.