A high-severity local file inclusion vulnerability in the AncoraThemes MaxCube theme allows unauthenticated attackers to read sensitive files or potentially execute arbitrary code.

This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements. An unauthenticated attacker can supply malicious input to trigger local file inclusion, potentially leading to information disclosure or system compromise.

The ability to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the host server. Attackers may gain unauthorized access to sensitive configuration files, environment variables, or credentials, which could lead to a full system compromise. Given the CVSS score of 8.2, this vulnerability represents a significant threat to organizational security and infrastructure integrity.

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate or uninstall the MaxCube theme if it is not essential for business operations.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting the WordPress environment.

Public Exploit Available: Unknown.

Due to the lack of an available patch, this vulnerability must be treated with high urgency. Organizations utilizing the AncoraThemes MaxCube theme should prioritize removing the software from their production environments or restricting access to the affected components until a vendor-supplied update becomes available. Failure to address this flaw leaves the application susceptible to unauthorized file access and potential remote code execution.