TMRW-studio Katerio Magazine WordPress Theme Local File Inclusion Vulnerability

A path traversal vulnerability allowing PHP local file inclusion has been identified in the TMRW-studio Katerio Magazine WordPress theme, affecting versions through 1.5.1. This vulnerability could allow a malicious actor to include local files from the target website and display their output, potentially leading to a complete database takeover depending on the site's configuration.

Impact

Exploitation of this vulnerability could allow for local file inclusion, with the potential to read sensitive files such as those containing database credentials. Depending on the site's configuration, this could lead to a complete takeover of the database.

Remediation

Users of the Katerio Magazine WordPress theme are advised to update to version 1.5.2 or later, where this vulnerability has been addressed.