An authenticated Local File Inclusion vulnerability in the ThemetechMount Boldman theme poses a significant security risk by allowing unauthorized access to sensitive server files.

This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements. An attacker with low-level privileges can manipulate these inputs to perform Local File Inclusion, which may lead to the disclosure or execution of arbitrary files on the host server.

The ability to perform Local File Inclusion can lead to a full compromise of the application, as attackers may read sensitive configuration files, environment variables, or source code. With a CVSS score of 7.5, this high-severity flaw threatens data confidentiality and integrity, potentially resulting in unauthorized system access or significant reputational damage if exploited.

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately audit their use of the Boldman theme and consider switching to a secure alternative or disabling the theme until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../../) or attempts to access system files like wp-config.php via theme-related file paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting theme files.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Patchstack vulnerability database entry referenced by the CVE record.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability must be treated with urgency. IT teams should restrict access to the affected theme and monitor for any indicators of compromise while awaiting an official security update from ThemetechMount. Prioritize the immediate removal of the vulnerable component to eliminate the attack surface entirely.