An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Notarius WordPress theme poses a high risk of unauthorized file access and potential code execution.

This vulnerability, classified as CWE-98, involves an improper control of filenames for include or require statements within the PHP codebase. An unauthenticated attacker can leverage this flaw to perform Local File Inclusion, potentially accessing sensitive files on the server.

The ability for an unauthenticated user to perform Local File Inclusion represents a severe security risk, as it may lead to the exposure of sensitive configuration files, database credentials, or other proprietary system data. Given the CVSS score of 8.1, this vulnerability carries significant weight and could result in full system compromise or unauthorized data exfiltration if exploited successfully.

Immediate Action: Since a specific patch version is not currently identified, administrators should verify if a newer version is available from the vendor or immediately deactivate the Notarius theme if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests, particularly those containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious PHP include requests targeting the theme directory.

Public Exploit Available: No (exploit_available: false).

Given the potential for unauthorized file access, organizations utilizing the AncoraThemes Notarius theme must prioritize the assessment of their exposure. Until a verified patch is provided by the vendor, the safest course of action is to disable the theme to prevent potential exploitation of the file inclusion mechanism.