The stmcan RT-Theme 18 | Extensions plugin is vulnerable to local file inclusion, which could allow an unauthenticated attacker to execute arbitrary code or access sensitive system files.

This vulnerability is a local file inclusion flaw (CWE-98) stemming from improper handling of filenames in include or require statements. An unauthenticated attacker can exploit this via the rt18-extensions component to read files or execute malicious code on the server.

Successful exploitation poses a significant risk to the integrity and confidentiality of the entire hosting environment. Given the CVSS score of 7.5, this high-severity vulnerability could lead to full system compromise, unauthorized data exfiltration, or the deployment of web shells, resulting in severe reputational damage and potential service disruption.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or uninstall the RT-Theme 18 | Extensions plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or unexpected file inclusions targeting the rt18-extensions directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the WordPress plugin environment.

Public Exploit Available: No.

Due to the nature of local file inclusion vulnerabilities, the risk of remote code execution or sensitive data exposure is high. Organizations utilizing the RT-Theme 18 | Extensions plugin must prioritize the immediate removal of this component from their WordPress installations. Security teams should continue to monitor vendor release channels for a patched version and perform a thorough audit of the server for signs of prior unauthorized access.