A high-severity local file inclusion vulnerability in the AncoraThemes Blabber theme allows unauthenticated attackers to read arbitrary files on the host server.

This vulnerability is a local file inclusion (CWE-98) flaw occurring within the theme's PHP include logic, which can be triggered by an unauthenticated attacker to manipulate file paths and access unauthorized content.

The ability to perform local file inclusion poses a severe risk to data confidentiality and integrity, as it may allow an attacker to read configuration files, source code, or sensitive system data. Given the CVSS score of 8.1, this vulnerability is classified as High, reflecting the potential for full system compromise or information disclosure that could lead to significant reputational and operational damage.

Immediate Action: There is currently no confirmed patch available; immediately deactivate the Blabber theme until a security update is released by AncoraThemes.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common file inclusion patterns.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Due to the severity of this file inclusion vulnerability, organizations should prioritize the immediate deactivation of the affected theme to eliminate the attack surface. Security teams must remain vigilant for vendor-provided updates and maintain robust logging to detect any potential unauthorized access attempts until a permanent fix is verified and applied.