The Wound WordPress Theme Local File Inclusion Vulnerability

A local file inclusion (LFI) vulnerability has been identified in the The Wound WordPress theme, versions through 0.0.1. The issue arises because the theme fails to properly validate certain parameters before using them to generate file paths for include functions. This lack of validation allows unauthenticated users to exploit the vulnerability, potentially leading to the download of arbitrary files from the server.

Impact

Exploitation of this vulnerability allows for local file inclusion, where an attacker can include files from the server's file system. This could be used to read sensitive files or, in some cases, execute code if the included file is processed by the server in a certain way.