A critical local file inclusion vulnerability in the axiomthemes Vocal theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

The theme fails to properly sanitize input before using it in file inclusion functions, allowing an unauthenticated attacker to perform local file inclusion. This flaw stems from improper control of filenames for include or require statements within the PHP code.

Successful exploitation of this vulnerability can lead to full server compromise, as local file inclusion often allows attackers to read sensitive configuration files or execute arbitrary PHP code on the underlying server. Given the CVSS score of 8.2, this represents a high-severity risk that could result in unauthorized data access, complete system compromise, and significant reputational damage.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Vocal theme if it is not business-critical or implement strict file system permissions to limit the scope of potential file access.

Proactive Monitoring: Monitor web server logs for suspicious requests containing directory traversal sequences or attempts to include unexpected system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and local file inclusion attempts targeting the theme directory.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Administrators are urged to prioritize the removal or mitigation of the affected theme until a formal security update is provided by the vendor. Continue to monitor official vendor channels for the release of a patched version.