A high-severity local file inclusion vulnerability in the Elated-Themes Laurent WordPress theme allows unauthenticated attackers to access sensitive files or achieve code execution.

This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's PHP implementation. An unauthenticated attacker can exploit this via crafted requests to include unauthorized files on the server.

The ability to perform local file inclusion poses a significant risk to organizational data and system integrity. An attacker could potentially read sensitive configuration files, credentials, or source code, which often leads to full system compromise or unauthorized access to backend databases. With a CVSS score of 8.1, this vulnerability is classified as high severity, and it must be addressed promptly to prevent data exfiltration.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Laurent theme if it is not business-critical. If the theme is required, restrict access to the affected environment and monitor vendor channels for the release of a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns, such as sequences of dot-dot-slash, or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and directory traversal attempts targeting the WordPress installation.

Public Exploit Available: Unknown.

The high CVSS score of 8.1 reflects the severe potential impact of this flaw on WordPress environments. Organizations should prioritize identifying all instances of the Laurent theme and applying strict access controls or removal until the vendor provides a validated security patch.