A critical local file inclusion vulnerability in the AxiomThemes Marveland theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

This vulnerability is a local file inclusion flaw (CWE-98) stemming from improper control of filenames used in include or require statements. The flaw allows an unauthenticated attacker to supply malicious input to the affected component to access or include unauthorized local files.

The ability to perform local file inclusion presents a severe risk to organizational data and system integrity. An attacker could potentially retrieve sensitive configuration files, credentials, or source code, which may lead to full system compromise or unauthorized access to the underlying WordPress environment. Given the CVSS score of 8.1, this vulnerability is categorized as high severity and requires immediate attention to prevent operational disruption.

Immediate Action: Users should audit their environment for the use of the Marveland theme and, if possible, switch to an alternative theme until a vendor-supplied security patch is released.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing path traversal characters like dot-dot-slash sequences or unexpected PHP file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion patterns and directory traversal attempts targeting the WordPress installation.

Public Exploit Available: No (exploit_available: false)

The vulnerability in the Marveland theme poses a significant security risk to the integrity of the web server. Administrators are urged to prioritize the removal or containment of the affected theme. Applying security updates as soon as they are made available by AxiomThemes is the only definitive method to eliminate this exposure.