AncoraThemes Zio Alberto contains a Local File Inclusion vulnerability that could allow an unauthenticated attacker to access sensitive server files.

This vulnerability, classified as CWE-98, occurs due to improper control of filenames in include or require statements. An unauthenticated attacker can leverage this flaw to perform Local File Inclusion, potentially leading to unauthorized data exposure or system compromise.

The ability to include local files can lead to the exposure of configuration files, credentials, or sensitive source code, severely compromising the confidentiality and integrity of the web application. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full system compromise if an attacker is able to execute arbitrary code through the included files.

Immediate Action: Since a specific patch version is currently unknown, users should audit the Zio Alberto theme for suspicious file inclusion patterns and restrict directory access permissions. Ensure the theme is updated to the latest available version if the vendor releases a fix.

Proactive Monitoring: Monitor web server access logs for requests containing directory traversal sequences, such as "../", or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue poses a substantial risk to the security of the hosting environment. Organizations should prioritize isolating the affected theme and implementing strict input validation or WAF protections until a verified security update is provided by AncoraThemes.