The AncoraThemes Isida theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive files or achieve unauthorized code execution.

The flaw, categorized as CWE-98, arises from improper validation of user-supplied input used in PHP include or require statements. This vulnerability is exploitable by unauthenticated attackers, potentially allowing them to include arbitrary local files on the server.

A successful exploit of this vulnerability could lead to the unauthorized disclosure of sensitive server files, configuration data, or internal source code. Given the CVSS score of 8.1, the risk of total system compromise is high, which could result in significant data breaches and severe reputational damage.

Immediate Action: Since no official patch is currently available, administrators should immediately deactivate or uninstall the Isida theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or unexpected file path requests, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and sanitize directory traversal attempts in URL parameters.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for total impact, organizations currently utilizing the AncoraThemes Isida theme must treat this as a high-priority security risk. Administrators should remove the affected software immediately and monitor systems for any signs of unauthorized access, pending further guidance or a security update from the vendor.