A high-severity Local File Inclusion vulnerability in the axiomthemes Panda WordPress theme allows unauthenticated attackers to compromise sensitive files or execute unauthorized code.

The vulnerability stems from improper control of filenames used in include or require statements, which facilitates Local File Inclusion (LFI). This flaw is exploitable by unauthenticated remote attackers who can manipulate input to access or execute arbitrary files on the server.

Successful exploitation of this vulnerability can lead to full server compromise, unauthorized access to sensitive configuration files, and potential remote code execution. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality, integrity, and system availability. Organizations should treat this as a high-priority threat that could lead to widespread service disruption or data breaches.

Immediate Action: Check the official Patchstack advisory or the WordPress dashboard for theme updates; if a patch is not yet available, immediately deactivate or uninstall the Panda theme.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block requests containing path traversal sequences or attempts to access unauthorized local files.

Public Exploit Available: No confirmed public exploit exists in the available data.

This vulnerability presents a severe risk to any WordPress instance utilizing the Panda theme. Administrators must verify if their environment is running version 1.21 or earlier and prioritize the removal of this theme until a secure update is verified as available. Continuous monitoring of server logs is essential until the vulnerability is fully addressed through patching or removal.