A high-severity local file inclusion vulnerability in the Magentech Victo WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

This is a local file inclusion vulnerability (CWE-98) occurring within the theme's PHP include/require logic. An unauthenticated attacker can supply malicious input to the vulnerable parameter, allowing them to include arbitrary local files on the server.

The exploitation of this flaw can lead to the exposure of sensitive configuration files, database credentials, or source code, resulting in complete system compromise. Given the CVSS score of 8.1, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance and the underlying server environment.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or uninstall the Victo theme until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php or etc/passwd.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences or attempts to access unauthorized PHP files.

Public Exploit Available: Unknown.

Due to the critical potential for unauthorized file access and the high CVSS score, this vulnerability should be prioritized for mitigation. If the Victo theme cannot be removed, ensure that the application is isolated and that monitoring is heightened until an official vendor update is applied.