A vulnerability in the axiomthemes Redy theme for WordPress allows unauthenticated attackers to perform local file inclusion, posing a significant risk to system confidentiality and integrity.

This is a local file inclusion vulnerability (CWE-98) occurring due to improper control of filenames used in PHP include statements. The flaw is exploitable by an unauthenticated remote attacker who can leverage the vulnerable endpoint to access arbitrary files on the server.

Successful exploitation allows an unauthorized party to read sensitive system files, configuration data, or application source code, potentially leading to full system compromise. With a CVSS score of 8.1, this high-severity vulnerability represents a substantial threat to organizational data security and service availability.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately disable or remove the Redy theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing path traversal patterns or references to sensitive files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter or block incoming requests containing directory traversal sequences or unexpected file inclusion parameters targeting the theme directory.

Public Exploit Available: No.

Given the high severity and the potential for unauthenticated access to sensitive system files, immediate action is required. Organizations utilizing the Redy theme should prioritize either updating to the latest secure version once released by axiomthemes or deactivating the component to eliminate the attack surface entirely.