A critical local file inclusion vulnerability in the AncoraThemes Hypnotherapy theme allows unauthenticated attackers to read arbitrary files from the server, posing a severe risk to system integrity.

This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to the exposure of sensitive configuration files or execution of malicious code.

The ability to perform local file inclusion allows an attacker to bypass authentication and access sensitive data stored on the web server. Given the CVSS score of 8.1, this vulnerability represents a high risk that could lead to full system compromise, unauthorized data exfiltration, and significant reputational damage.

Immediate Action: Since no specific patch is currently confirmed, users should immediately deactivate the Hypnotherapy theme if it is not business critical or switch to a secure alternative.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unexpected file inclusion requests targeting the theme directory.

Public Exploit Available: Unknown.

Given the high CVSS severity and the nature of the flaw, administrators must prioritize the protection of their WordPress environments. If the Hypnotherapy theme cannot be updated to a secure version, it should be removed or disabled immediately to prevent potential exploitation. Consistent monitoring of server logs and the implementation of robust WAF rules are essential until a definitive vendor patch is verified and deployed.