WordPress Mission theme <= 1.22 - Local File Inclusion vulnerability

Vulnerability

An unauthenticated Local File Inclusion (LFI) vulnerability exists in the Mission WordPress theme version 1.22 and earlier [1]. No authentication is required to reach the vulnerable code path, making the flaw trivially exploitable on any site running the affected theme version.

Exploitation

An attacker with network access to the target website can send a specially crafted HTTP request without any prior authentication or user interaction [1]. The vulnerable parameter allows including arbitrary local files from the server's filesystem, outputting their contents in the HTTP response. This attack requires no elevated privileges or special conditions.

Impact

Successful exploitation allows an unauthenticated attacker to read sensitive local files from the server, such as wp-config.php which contains database credentials [1]. This could lead to complete database takeover depending on the server configuration. The vulnerability is considered highly dangerous and is expected to be used in mass-exploit campaigns [1].

Mitigation

Update the Mission theme to version 1.23 or later as soon as possible [1]. If unable to update immediately, consult your hosting provider or web developer for alternative protections, though no complete workaround has been published at this time [1].