The Gavias Kunco WordPress theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

The vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's handling of include statements. Because the CVSS vector indicates no authentication is required (PR:N), an unauthenticated attacker can potentially trigger this issue to access or execute arbitrary files on the underlying server.

This vulnerability poses a significant risk to the integrity and confidentiality of the host environment. A successful exploit could lead to the exposure of sensitive configuration files, credentials, or the execution of malicious code, potentially resulting in full system compromise. With a CVSS score of 8.1, this flaw is considered high severity due to the potential for total impact on system availability, integrity, and confidentiality.

Immediate Action: Users of the Gavias Kunco theme must update to version 1.4.5 or later immediately to address this security flaw.

Proactive Monitoring: Security teams should monitor web server access logs for unusual file paths or directory traversal patterns, such as sequences containing "../", targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal characters or suspicious file path inclusions directed at the WordPress theme directory.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for complete system compromise, administrators should treat this vulnerability with high priority. We strongly recommend applying the vendor-supplied update to version 1.4.5 as soon as possible. If an immediate update is not feasible, ensure that the theme is disabled or that the server is protected by robust WAF rules to prevent unauthorized file access.