A high-severity Local File Inclusion vulnerability in the AncoraThemes Rare Radio theme permits unauthenticated attackers to access sensitive files on the host server.

This vulnerability is categorized as CWE-98, involving improper control of filenames used in PHP include or require statements. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to the disclosure of sensitive server information or execution of arbitrary local scripts.

The ability to include local files can lead to a full compromise of the web application, including the theft of configuration files, database credentials, or sensitive user data. With a CVSS score of 8.2, this vulnerability represents a significant risk to confidentiality, integrity, and availability, as it allows attackers to bypass standard access controls without requiring prior authentication.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official AncoraThemes patch repository for an update that addresses this LFI flaw. If no update is available, consider switching to a different theme or disabling the Rare Radio theme until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Public Exploit Available: No.

Given the high CVSS severity and the potential for unauthorized access to sensitive system files, this vulnerability should be treated with urgency. We recommend immediate review of current theme versions and the implementation of WAF filtering to mitigate potential exploitation attempts while awaiting a formal vendor patch.