A critical local file inclusion vulnerability in the AncoraThemes Mr. Cobbler theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

This vulnerability is a Local File Inclusion (CWE-98) flaw occurring within the Mr. Cobbler theme. An unauthenticated attacker can manipulate file paths to include arbitrary files, leading to unauthorized information disclosure or remote code execution.

The ability for an unauthenticated user to include arbitrary files poses a severe threat to the confidentiality, integrity, and availability of the WordPress environment. Successful exploitation could allow an attacker to read configuration files containing database credentials or execute malicious PHP code, potentially resulting in a full site compromise. With a CVSS score of 8.1, the high severity reflects the significant risk of total system impact.

Immediate Action: Review the Patchstack advisory for the latest vendor guidance, as a specific patch version is currently not documented in the provided data. If no update is available, deactivate the Mr. Cobbler theme immediately.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal patterns, such as sequences of dots and slashes, directed at theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting the WordPress theme directory.

Public Exploit Available: Unknown

Given the potential for complete system compromise, administrators should treat this vulnerability with extreme urgency. If a vendor-provided update is not available for the Mr. Cobbler theme, users should consider switching to an alternative, secure theme until the vulnerability is addressed by the developer to mitigate the risk of unauthorized access.