A high-severity Local File Inclusion vulnerability in the Select-Themes Struktur WordPress theme allows authenticated attackers to potentially access sensitive server files.

This vulnerability involves improper control of filenames used in PHP include statements, which can be exploited by an authenticated attacker with low privileges to perform Local File Inclusion (LFI) attacks.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive server-side information, including system configuration files or environment credentials. The CVSS score of 7.5 reflects the high impact on confidentiality and integrity, necessitating prompt mitigation to prevent potential data breaches.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate or remove the Struktur theme until the vendor releases a security update.

Proactive Monitoring: Monitor server logs for suspicious directory traversal attempts or unauthorized attempts to include sensitive PHP files.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming HTTP requests for common LFI patterns and block malicious payloads targeting the theme.

Public Exploit Available: No

Due to the high severity and the absence of a direct patch, organizations should treat this as an urgent security requirement. Deactivating the theme is the only effective way to neutralize the risk until the vendor provides a secure version.