Long story short, a client website basically crashed because the auto-update to v9.5.6 installed a faulty theme package which is missing crucial files such as the style.css or other functional php files.
I assume this issue is not unknown to the developer team.
I didn’t read anything about this in the (outdated!) change log on the website (https://laytheme.com/version-history.html).
In terms of vulnerability concerns I kindly ask to give full transparency regarding this issue.
Did someone just sleep and publish a wrong release or is this a security issue which needs further attention?
LOG
---
[15:17:11] Start comparing "/Lay Theme Versions/lay 9.5.5" ↔ "/Lay Theme Versions/lay 9.5.6"
[15:17:11] Scanning "/Lay Theme Versions/lay 9.5.5"
[15:17:11] Found 763 entries
[15:17:11] Scanning "/Lay Theme Versions/lay 9.5.6"
[15:17:11] Found 628 entries
[15:17:11] Creating stats for diff result
[15:17:11] Compared 1391 entries
SETTINGS
---
Abort on Error: true
Excludes: "**/.DS_Store", "**/.git", "**/.hg", "**/.svn", "**/CVS", "**/node_modules"
Ignore Contents: false
Ignore End of Line: true
Ignore Byte Order Mark: true
Ignore Leading/Trailing Whitespace: false
Max File Size: 0
Use Case Sensitive: false
INFO
---
Compared: "/Lay Theme Versions/lay 9.5.5" ↔ "/Users/admin/Downloads/Lay Theme Versions/lay 9.5.6"
Entries: 1391 (1124 files, 267 folders)
Size: 18.84 MB (19753611 Bytes)
Left Path: "/Lay Theme Versions/lay 9.5.5"
Entries: 763 (615 files, 148 folders)
Size: 9.84 MB (10322053 Bytes)
Right Path: "/Lay Theme Versions/lay 9.5.6"
Entries: 628 (509 files, 119 folders)
Size: 8.99 MB (9431558 Bytes)
RESULT
---
Comparisons: 763
Diffs: 159
Conflicts: 0
Created: 0
Deleted: 135 (106 files, 29 folders)
Modified: 24 (48 files)
Unchanged: 604 (970 files, 238 folders)
Ignored: 0
I fixed the client website by manually installing v9.5.5 and disabling auto-updates.