The Ovatheme Tripgo theme contains a critical local file inclusion vulnerability that allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

The theme fails to properly validate filenames before passing them to PHP include or require statements, enabling a local file inclusion attack. This flaw is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to access sensitive configuration files, credentials, or other critical data stored on the web server. Given the CVSS score of 8.1, the high potential for confidentiality, integrity, and availability impact poses a significant risk to organizational security and could lead to full system compromise.

Immediate Action: Since a specific patch version is not currently identified, users should disable or switch to an alternative theme until a vendor-supplied update is verified.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or unexpected file extensions in request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and directory traversal attempts.

Public Exploit Available: Yes, a technical write-up detailing the vulnerability exists via Patchstack.

This vulnerability represents a high-risk entry point into the web environment. Administrators must prioritize the containment of this threat by restricting access to the affected theme and monitoring for any signs of unauthorized file access. Immediate transition to a secure theme version is mandatory once the vendor releases a fix.