EPC Massive Dynamic WordPress Theme Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the EPC Massive Dynamic WordPress theme, affecting versions through 8.2. This vulnerability arises from improper control of filenames in include or require statements, allowing for the inclusion of local files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, potentially including sensitive information such as database credentials. Depending on the server configuration, this could allow for a complete takeover of the database.

Remediation

Users of the EPC Massive Dynamic WordPress theme are advised to update to a version later than 8.2. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.