ThimPress Ivy School Path Traversal Vulnerability Leading to Local File Inclusion

A path traversal vulnerability allowing PHP local file inclusion has been identified in the ThimPress Ivy School WordPress theme, affecting versions through 1.6.0. This vulnerability could enable the inclusion of local files from the target website, potentially exposing sensitive information such as database credentials, which could lead to a complete database takeover depending on the configuration.

Impact

Exploitation of this vulnerability could allow unauthorized inclusion of local files, with the potential to expose sensitive information such as database credentials. Depending on the site's configuration, this could result in a complete takeover of the database.

Remediation

Users are advised to update to version 1.6.1 or later. Patchstack has also issued a virtual patch to mitigate this vulnerability until users can update.