A critical Local File Inclusion vulnerability in the axiomthemes Nirvana WordPress theme could allow unauthenticated attackers to access sensitive files on the server.

This flaw is an Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), which permits an unauthenticated attacker to perform Local File Inclusion. The vulnerability resides within the theme's handling of include operations, allowing the execution or inclusion of arbitrary local files.

The exploitation of this vulnerability poses a severe risk to organizational security, as it may lead to unauthorized disclosure of sensitive configuration files, source code, or internal data. With a CVSS score of 8.1, the potential for high-impact compromise of confidentiality, integrity, and availability is significant, necessitating urgent remediation to prevent potential system-wide compromise.

Immediate Action: There is no official patch currently available; administrators should immediately disable or remove the Nirvana theme until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting the theme directory.

Public Exploit Available: No (exploit_available: false).

The vulnerability represents a significant security risk due to the potential for unauthorized file access and remote execution. Given the lack of an available patch, organizations must prioritize the immediate deactivation of the affected theme to maintain a secure posture. Ensure that all alternative themes are updated and that the environment is reviewed for signs of previous unauthorized access.