A high-severity Local File Inclusion vulnerability in the Elated-Themes NeoBeat WordPress theme could allow an unauthenticated attacker to access or execute sensitive files on the server.

The theme fails to properly sanitize input used in PHP include or require statements, enabling a Local File Inclusion (LFI) flaw. This vulnerability is accessible to unauthenticated attackers via the network.

Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web server or execute malicious PHP code. This poses a severe risk of full system compromise, sensitive data exposure, and unauthorized administrative access. With a CVSS score of 8.1, this represents a significant threat to the confidentiality, integrity, and availability of the hosting environment.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable or remove the NeoBeat theme if it is not mission-critical. Contact the vendor for the latest security release or monitor the Patchstack database for updates.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common LFI payloads.

Public Exploit Available: Unknown.

Given the potential for remote code execution and unauthorized file access, this vulnerability must be treated with high priority. Organizations utilizing the NeoBeat theme should verify their current version and implement restrictive access controls immediately. Until a vendor-supplied patch is confirmed and applied, removing the vulnerable software remains the most effective mitigation strategy.