An unauthenticated Local File Inclusion vulnerability in the AncoraThemes W&D theme creates a high risk of remote code execution and unauthorized file access.

The theme suffers from improper control of filenames for include statements, which allows an unauthenticated attacker to perform Local File Inclusion. This flaw enables the execution of arbitrary PHP code or the unauthorized retrieval of sensitive configuration files from the server.

The exploitation of this vulnerability can lead to a total compromise of the affected WordPress site, including the potential for remote code execution. With a CVSS score of 8.2, this is a High severity issue that could result in full data exfiltration, unauthorized modification of site content, and potential lateral movement within the hosting environment.

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate and remove the W&D theme until a security update is released by AncoraThemes.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions, such as references to etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion patterns to mitigate risk until the theme can be updated or replaced.

Public Exploit Available: Unknown.

Given the high severity and the potential for complete site takeover, immediate action is required to secure the environment. Organizations currently utilizing the AncoraThemes W&D theme should prioritize its removal or replacement to eliminate the attack vector, as the lack of a vendor-provided patch leaves the system exposed to potential exploitation.