A high-severity local file inclusion vulnerability in the AxiomThemes SevenTrees WordPress theme allows unauthenticated attackers to read arbitrary files on the host server.

This vulnerability is a Local File Inclusion (CWE-98) flaw that permits an unauthenticated attacker to manipulate file paths within the theme, potentially leading to unauthorized disclosure of sensitive server information or code execution. The vulnerability is reachable via the network without requiring user authentication.

The vulnerability carries a CVSS score of 8.1, reflecting a high potential for impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to bypass security restrictions to access sensitive configuration files or credentials stored on the server, which could lead to a full compromise of the WordPress installation and the underlying hosting environment.

Immediate Action: As no official patch is currently identified, users should immediately deactivate and remove the SevenTrees theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal sequences, such as dot-dot-slash patterns, directed at theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and detect unauthorized file inclusion requests targeting the WordPress theme directory.

Public Exploit Available: Unknown.

Given the severity of this file inclusion flaw, administrators must treat this as a critical configuration risk. Immediate deactivation of the vulnerable SevenTrees theme is the most effective way to eliminate the attack surface until the vendor provides a formal security update.