A high-severity Local File Inclusion vulnerability in the Elated-Themes Amoli theme poses a significant risk of unauthorized file access and potential system compromise.

The theme contains an improper control of filename for include or require statements, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to perform Local File Inclusion, which may lead to the disclosure of sensitive files or execution of arbitrary code depending on the server environment.

Successful exploitation of this vulnerability could lead to the unauthorized exposure of sensitive configuration files, credentials, or source code stored on the web server. Given the CVSS score of 8.1, this flaw represents a significant risk to the confidentiality and integrity of the WordPress installation, potentially facilitating further system compromise or data exfiltration.

Immediate Action: Since no specific patch version is currently identified, administrators should monitor the vendor website for security updates and apply them immediately upon release. If an update remains unavailable, consider switching to a more secure theme or disabling the Amoli theme until a fix is provided.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests for sensitive system files (e.g., wp-config.php) via URL parameters.

Compensating Controls: Deploy or update Web Application Firewall rules to block requests containing path traversal sequences or attempts to include unexpected local files.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to WordPress environments using the Amoli theme. Security teams should prioritize identifying all instances of the affected software within their infrastructure and implement temporary containment measures, such as WAF filtering, until the vendor releases a definitive security update.