A critical local file inclusion vulnerability in the AxiomThemes Jude WordPress theme allows unauthenticated attackers to access sensitive files or potentially execute arbitrary code.

This vulnerability, classified as CWE-98, stems from the improper handling of user-supplied input within PHP include or require functions. An unauthenticated attacker can manipulate these parameters to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

The exploitation of this vulnerability could lead to a total compromise of the affected WordPress instance. Because the flaw allows for local file inclusion, attackers may read sensitive configuration files, such as wp-config.php, or execute arbitrary PHP code, resulting in full site takeover, data exfiltration, and significant reputational damage. The CVSS score of 8.1 reflects the high severity of the potential impact on confidentiality, integrity, and availability.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or disable the Jude theme entirely until a vendor-supplied update is available.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting common PHP include structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious PHP inclusion patterns to provide a temporary layer of protection.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, organizations currently utilizing the AxiomThemes Jude theme must treat this vulnerability with high urgency. Immediately audit your environment for the presence of this theme and implement the recommended compensating controls if a complete removal is not immediately feasible. Prioritize the transition to a secure alternative until the vendor releases a verified security update.