A high-severity local file inclusion vulnerability in the ThemeREX Le Truffe WordPress theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

This flaw is a Local File Inclusion (LFI) vulnerability categorized under CWE-98, which occurs due to improper sanitization of filenames passed to PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. Successful attackers can read sensitive system files, configuration files, or potentially execute arbitrary code on the server, which may lead to a complete compromise of the web application. Given the CVSS score of 8.1, the potential for total impact necessitates immediate attention despite the high attack complexity.

Immediate Action: Check the WordPress dashboard or the vendor website for an update beyond version 1.1.7; if no patch is available, consider switching to a different theme or disabling the affected software.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as "../", which are often indicative of LFI attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion requests to the server.

Public Exploit Available: Unknown.

Given the severity of potential file inclusion attacks, administrators should prioritize replacing or updating the Le Truffe theme. If an official patch has not been released by ThemeREX, the theme should be deactivated immediately to prevent unauthorized access or system-wide compromise while a permanent fix is sought.