The AncoraThemes Fabrica theme for WordPress contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to access sensitive files or execute arbitrary code.

This flaw is classified as a local file inclusion (CWE-98) vulnerability. It allows an unauthenticated attacker to manipulate input parameters to include unauthorized files, potentially resulting in full system compromise.

A successful exploit of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. Given the CVSS score of 8.2, this is a high-severity issue that could lead to unauthorized data exfiltration, remote code execution, or complete site takeover by an unauthenticated remote actor.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately audit their use of the Fabrica theme and consider switching to a secure, supported alternative until a vendor update is confirmed.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common path traversal and local file inclusion attack vectors targeting PHP applications.

Public Exploit Available: Unknown.

Due to the high severity of this file inclusion vulnerability, immediate action is required to reduce the attack surface. If you are currently running AncoraThemes Fabrica version 1.8.1 or earlier, isolate the affected application from public networks or implement strict WAF filtering until the vendor releases a security update that explicitly addresses this flaw.