An unauthenticated local file inclusion vulnerability in the AncoraThemes OnLeash WordPress theme poses a high risk of unauthorized file access and remote code execution.

This vulnerability, classified as CWE-98, occurs because the theme fails to properly sanitize user-supplied input before using it in a PHP include or require statement. An unauthenticated attacker can leverage this flaw to include arbitrary local files, potentially leading to information disclosure or remote code execution.

The exploitation of this vulnerability could lead to a total compromise of the affected WordPress instance. With a CVSS score of 8.2, this issue represents a high-severity threat that could result in sensitive data theft, unauthorized system modification, or complete service disruption.

Immediate Action: Since no specific patch version is documented, users should monitor the vendor's security advisory page and immediately update the OnLeash theme as soon as a fix is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and restrict access to sensitive application files.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, administrators must treat this vulnerability with high priority. We recommend disabling the OnLeash theme if it is not strictly necessary until an official vendor update is applied to remediate the underlying code flaw.