The axiomthemes Photolia WordPress theme contains a high-severity local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive files on the server.

This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can exploit this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Successful exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.1, the flaw is classified as High severity and could allow an attacker to read sensitive configuration files or execute arbitrary PHP code, potentially leading to a full system compromise.

Immediate Action: Since no specific patch is currently identified, users should immediately deactivate or uninstall the Photolia theme if it is not business-critical. Monitor vendor channels for the release of a security update and apply it as soon as it becomes available.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or references to sensitive files like wp-config.php. Monitor for anomalous PHP execution patterns that deviate from expected application behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common file inclusion attack patterns and directory traversal attempts. Ensure the underlying server environment is hardened to restrict the web service account from accessing sensitive system files.

Public Exploit Available: exploit_available (unknown)

Given the High severity of this vulnerability and the potential for complete site takeover, organizations currently running the Photolia theme must treat this as a priority. If the theme cannot be removed, ensure that robust WAF protections are in place and that the application is running with the principle of least privilege to minimize the impact of a potential compromise.