The Peter Mason theme for WordPress contains a critical file inclusion vulnerability that allows unauthenticated attackers to access sensitive local system files.

This vulnerability, categorized as CWE-98, stems from improper control of filenames used in include or require statements. An unauthenticated attacker can manipulate these inputs to perform local file inclusion, potentially leading to unauthorized data disclosure or code execution.

The ability for an unauthenticated user to perform local file inclusion poses a severe risk to the confidentiality and integrity of the hosting environment. Successful exploitation could allow an attacker to read sensitive configuration files or credentials, leading to full system compromise. With a CVSS score of 8.1, this high severity flaw warrants immediate attention to prevent unauthorized access to the underlying server infrastructure.

Immediate Action: Administrators should immediately deactivate the Peter Mason theme until a security update is released by ThemeREX. If an update becomes available, apply the patch immediately to resolve the vulnerable file inclusion path.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns or unusual file inclusion attempts. Monitor for anomalous traffic directed at PHP files within the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and malicious file inclusion attempts. Ensure the web server process runs with the least privilege necessary to limit the impact of potential file access.

Public Exploit Available: No (exploit_available: false).

Given the high CVSS score and the potential for total system impact, this vulnerability represents a significant security risk. Administrators are urged to prioritize the removal or patching of the affected theme. Until a verified patch is provided by the vendor, deactivation is the only reliable method to eliminate the risk of exploitation.