A high-severity Local File Inclusion vulnerability in the WP Royal News Magazine X theme could allow unauthenticated attackers to execute arbitrary PHP code or access sensitive system files.

The theme fails to properly sanitize input used in PHP include statements, which permits an unauthenticated attacker to perform Local File Inclusion (LFI). This flaw specifically targets the file handling logic, potentially leading to total compromise of the application.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. An attacker may read sensitive configuration files or execute arbitrary code on the server, leading to full site takeover and potential data exfiltration. Given the CVSS score of 7.5, this vulnerability represents a significant threat to business operations and data security.

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate the News Magazine X theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or attempts to access non-existent PHP files within the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts to mitigate the risk while the theme is in use.

Public Exploit Available: Yes, a technical write-up detailing the vulnerability exists via the Patchstack database reference.

The severity of this Local File Inclusion flaw necessitates immediate attention. Organizations utilizing the WP Royal News Magazine X theme must prioritize deactivating the software to prevent unauthorized code execution. We strongly advise monitoring vendor release channels for a patched version and validating any update against security best practices before restoration.