A high-severity local file inclusion vulnerability in the StylemixThemes Consulting theme permits authenticated attackers to access sensitive system files.

The flaw is categorized as CWE-98, involving improper control of filenames for include or require statements. This vulnerability requires the attacker to have low-level privileges to trigger the file inclusion process.

The ability to perform local file inclusion allows an attacker to read sensitive configuration files or execute arbitrary code on the underlying server. This poses a significant risk of full site compromise, data theft, and potential lateral movement within the hosting environment, justifying the high CVSS score of 7.5.

Immediate Action: Update the Consulting theme to version 6.7.5 or later to resolve the underlying inclusion vulnerability.

Proactive Monitoring: Review web server access logs for requests containing suspicious path traversal patterns or unexpected file inclusion attempts targeting PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious requests attempting to manipulate file paths or include unauthorized external resources.

Public Exploit Available: Unknown.

Organizations utilizing the Consulting theme must prioritize updating to version 6.7.5 immediately. Given the nature of file inclusion vulnerabilities, failure to patch leaves the application susceptible to unauthorized file access and potential server takeover, which necessitates swift administrative intervention to maintain the security of the web environment.