A high-severity local file inclusion vulnerability in the UnTheme OrganicFood theme allows authenticated attackers to potentially access sensitive system files.

This vulnerability is a local file inclusion flaw stemming from improper handling of filenames in PHP include statements. It requires the attacker to have at least low-level authenticated access to the target WordPress environment to trigger the malicious file inclusion.

The ability to perform local file inclusion poses a significant risk to the confidentiality and integrity of the hosting environment. By traversing the file system, an attacker could read sensitive configuration files, such as wp-config.php, potentially leading to database credential exposure and full site compromise. With a CVSS score of 7.5, this vulnerability represents a high risk that could result in unauthorized data access or total service disruption.

Immediate Action: Review the official UnTheme vendor portal for the latest security release, and update the OrganicFood theme to the version succeeding 3.6.4 immediately upon release.

Proactive Monitoring: Monitor server access logs for suspicious URL patterns containing directory traversal sequences, such as "../", which are common indicators of file inclusion attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict access to sensitive PHP source files.

Public Exploit Available: No.

Given the potential for complete system compromise through unauthorized file access, IT administrators should prioritize the remediation of this vulnerability. If an official patch is not yet available, restrict access to the affected application and implement robust WAF filtering to mitigate the risk of exploitation until a secure version can be deployed.