A high-severity local file inclusion vulnerability in the Elated-Themes Gaspard theme exposes the underlying server to potential unauthorized file access and remote code execution.

This flaw is classified as a CWE-98 vulnerability, where the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can exploit this to perform local file inclusion, potentially leading to the disclosure of sensitive server files or the execution of arbitrary code.

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system. With a CVSS score of 8.1, this flaw allows an attacker to bypass standard application access controls, which may lead to total system compromise or the exfiltration of sensitive configuration files and application data.

Immediate Action: Review the vendor advisory for any available patches and update the Gaspard theme to the latest secure version immediately. If no patch is currently available, consider switching to an alternative, supported theme until a fix is released.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal attempts or requests for sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full system compromise, administrators should treat this vulnerability with high urgency. Ensure that the WordPress installation is running with the principle of least privilege to limit the impact of a successful file inclusion attack, and apply vendor updates as soon as they become available.