The AncoraThemes Dentalux theme contains a critical local file inclusion vulnerability that permits unauthenticated attackers to access sensitive server files.

The theme suffers from improper control of filenames used in include or require statements, categorized as CWE-98. This flaw allows an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data disclosure or system compromise.

Successful exploitation of this vulnerability can lead to full system compromise, as it allows attackers to read arbitrary files from the web server. Given the CVSS score of 8.1, this is a high-severity issue that poses a significant risk to data confidentiality and integrity. If the web server contains configuration files, credentials, or application source code, these assets could be exfiltrated and used to facilitate further attacks against the organization.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately audit their use of the Dentalux theme and consider switching to an alternative if a vendor update is not promptly released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests containing unusual file paths and PHP include parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and path traversal sequences.

Public Exploit Available: Unknown.

Due to the high severity of this file inclusion vulnerability, organizations running the affected version of the Dentalux theme must prioritize remediation. While a formal patch status is unknown, administrators should monitor the vendor's security advisory portal for updates and apply them immediately upon release. Until such time, implementing strict ingress filtering and WAF protections is essential to reduce the attack surface.