Mikado Themes MediClinic Path Traversal Vulnerability Leading to Local File Inclusion

A path traversal vulnerability has been identified in the Mikado Themes MediClinic WordPress theme, specifically in versions through 2.1. This vulnerability allows for PHP local file inclusion, which could enable a malicious actor to include and execute local files from the server, potentially leading to the exposure of sensitive information such as database credentials.

Impact

Exploitation of this vulnerability could allow for local file inclusion, with the included files being executed as PHP scripts. This could lead to the exposure of sensitive information, such as database credentials, and depending on the server configuration, could allow for a complete takeover of the database.

Remediation

Users are advised to update to version 2.2 or later to address this vulnerability. Patchstack has also issued a virtual patch to mitigate the issue until users can update.