A high-severity local file inclusion vulnerability in the axiomthemes Little Birdies WordPress theme allows unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

The theme suffers from a Local File Inclusion (LFI) flaw, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to manipulate file paths to include unauthorized files, potentially resulting in full system compromise.

The exploitation of this vulnerability could lead to the exposure of sensitive configuration files, source code, or internal data, and may facilitate remote code execution. Given the CVSS score of 8.1, this represents a significant security risk that could result in total system compromise and severe reputational damage.

Immediate Action: Since no specific patch version is confirmed, users should immediately deactivate or uninstall the Little Birdies theme if it is not business-critical. If the theme must remain in use, monitor vendor channels for the release of version 1.3.17 or higher.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and requests targeting PHP include or require parameters.

Public Exploit Available: No (There is no confirmed public exploit or weaponized code available for this vulnerability).

Given the potential for complete system compromise, administrators must prioritize the removal or containment of the Little Birdies theme. Until a verified security update is provided by the vendor, limiting the impact via WAF rules and strict file system permissions is essential to prevent unauthorized access.