The AncoraThemes Parkivia theme is vulnerable to Local File Inclusion, which poses a high risk of unauthorized file access and potential system compromise for affected WordPress installations.

This vulnerability is a Local File Inclusion (CWE-98) flaw caused by improper control of filenames used in include or require statements within the PHP code. An unauthenticated attacker can exploit this via the network to read sensitive server files or execute arbitrary code.

Successful exploitation allows an attacker to read sensitive configuration files or execute malicious PHP scripts on the underlying server. Given the CVSS score of 8.1, this vulnerability presents a significant risk to data confidentiality and integrity, potentially leading to complete system compromise if the theme is used in a high-privilege environment.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the AncoraThemes website for security updates and apply them as soon as they become available. If no update is provided, consider switching to a different theme or disabling the affected functionality if possible.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unexpected file inclusion requests targeting the theme directory.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical security gap for WordPress sites utilizing the Parkivia theme. Security teams must prioritize patching as soon as the vendor releases a fix, while maintaining strict monitoring for any anomalous activity that might indicate an attempt to leverage this file inclusion flaw.