An unauthenticated local file inclusion vulnerability in the Select-Themes Tonda WordPress theme poses a high risk of complete system compromise.

This vulnerability is a local file inclusion issue stemming from improper control of filenames in PHP include statements. It allows an unauthenticated attacker to execute arbitrary local files on the server.

The vulnerability carries a CVSS score of 8.1, reflecting its high potential impact on confidentiality, integrity, and availability. Successful exploitation could lead to full unauthorized access to sensitive application data, potential remote code execution, and total compromise of the WordPress environment, resulting in significant operational downtime and reputational damage.

Immediate Action: Update the Tonda WordPress theme to version 2.6 or later immediately.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal sequences or unexpected file inclusion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious file inclusion patterns and directory traversal attempts.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this file inclusion vulnerability, administrators should prioritize updating the Tonda theme to version 2.6 as soon as possible. Failure to patch allows for unauthenticated access, which could lead to a complete takeover of the affected web application.