A high-severity local file inclusion vulnerability in the AncoraThemes Greenville WordPress theme could allow an unauthenticated attacker to read arbitrary files or execute code on the server.

This flaw is a Local File Inclusion (CWE-98) occurring within the theme's PHP include mechanisms. The vulnerability is exploitable by an unauthenticated attacker who can manipulate file paths to access sensitive system files or execute malicious scripts.

The potential for unauthorized file access and remote code execution poses a significant threat to data confidentiality and system integrity. Given the CVSS score of 8.1, successful exploitation could lead to full compromise of the WordPress environment, resulting in data breaches, installation of backdoors, or complete service disruption.

Immediate Action: Since no official patch version is currently identified, users should immediately deactivate and uninstall the Greenville theme if it is not business-critical. If the theme must remain in use, restrict access to the web server and monitor for suspicious file-inclusion patterns.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences or attempts to include unexpected PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and directory traversal attempts.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk due to the potential for unauthorized code execution. Administrators should prioritize the removal of the vulnerable component or implement strict WAF protections while awaiting a formal vendor security update. Continued vigilance and regular auditing of theme components are essential to maintaining a secure WordPress environment.