WordPress Grecko theme <= 5.17 - Local File Inclusion vulnerability

Vulnerability

The Grecko WordPress theme versions up to and including 5.17 contain an unauthenticated Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to include arbitrary local files from the server without requiring any authentication or prior privileges. The vulnerability is present in the theme's file handling mechanism, which fails to properly sanitize user-supplied input before including files. [1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the affected WordPress site, manipulating a file parameter to include arbitrary local files. No authentication or user interaction is required. The attack can be performed remotely over the network, making it accessible to any unauthenticated visitor. [1]

Impact

Successful exploitation allows the attacker to read the contents of any local file on the server, including sensitive files such as wp-config.php which contains database credentials. This could lead to complete database compromise depending on the server configuration. The vulnerability is rated with a CVSS score of 8.1 (High) and is expected to be used in mass-exploit campaigns. [1]

Mitigation

Users should update the Grecko theme to a version higher than 5.17 as soon as a patched version is released. If immediate update is not possible, it is recommended to contact the hosting provider or a web developer for assistance. No other workarounds are currently available. [1]