A critical local file inclusion vulnerability in the AncoraThemes Midi theme allows unauthenticated attackers to read sensitive system files, posing a significant risk to data confidentiality and integrity.

The vulnerability is a local file inclusion (CWE-98) occurring within the theme code. It allows an unauthenticated attacker to manipulate file paths in include statements to access arbitrary files on the underlying server.

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, database credentials, or application source code. Given the CVSS score of 8.1, this is a high-severity issue that could result in total compromise of the application environment, leading to potential data breaches and unauthorized administrative access.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately deactivate the Midi theme if it is not business critical or contact the vendor for an urgent update.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward theme-related PHP files.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block directory traversal attempts and malicious URL parameters that target file inclusion functions.

Public Exploit Available: Unknown

The severity of this local file inclusion vulnerability necessitates immediate attention to prevent unauthorized system access. Security teams should treat the Midi theme as high risk and implement strict access controls or switch to an alternative theme until a verified vendor patch is deployed.