A high-severity local file inclusion vulnerability in the AncoraThemes Anderson WordPress theme poses a significant risk of unauthorized file access and potential code execution.

This vulnerability involves improper control of filenames used in PHP include or require statements, which allows an unauthenticated attacker to perform local file inclusion. By manipulating input parameters, an attacker can force the application to include arbitrary local files on the server.

The ability to include local files can lead to the exposure of sensitive configuration files, credentials, or source code, and may facilitate remote code execution if an attacker can influence the content of the included file. Given the CVSS score of 8.1, this flaw is categorized as high severity and represents a critical threat to the confidentiality and integrity of the hosting environment.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Anderson theme if it is not business critical.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal sequences or attempts to access system configuration files via PHP parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of local file inclusion vulnerabilities, organizations should treat this as a priority. Administrators are urged to restrict access to the affected site or remove the theme until the vendor releases a security update that addresses the underlying file inclusion mechanism.