A high-severity Local File Inclusion vulnerability in the VanKarWai Airtifact theme could allow authenticated attackers to compromise server integrity and access sensitive data.

This is a PHP Local File Inclusion (LFI) flaw, categorized as CWE-98, caused by improper control of filenames in include or require statements. The vulnerability requires the attacker to have low-level authenticated access to the application to trigger the malicious file inclusion.

Successful exploitation of this vulnerability allows an authenticated attacker to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, or sensitive application data. Given the CVSS score of 7.5, this flaw poses a significant risk to confidentiality and integrity. If the attacker can influence the inclusion of files containing executable code, they may gain unauthorized remote code execution capabilities, leading to full system compromise.

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately audit the Airtifact theme for any unauthorized modifications and disable the theme if it is not business-critical.

Proactive Monitoring: Monitor server access logs for suspicious path traversal patterns, such as sequences like "../" or unexpected file extensions being passed as parameters to theme-related PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict access to sensitive system files to mitigate the risk while awaiting a vendor-supplied update.

Public Exploit Available: Unknown.

The vulnerability presents a serious risk to the underlying server environment. Organizations currently using the VanKarWai Airtifact theme must treat this as a high-priority item, restricting user access to the affected components and monitoring for any signs of unauthorized file access until a formal patch is released by the vendor.