A high-severity local file inclusion vulnerability in the ThemeREX Melania WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

This vulnerability, classified as CWE-98, occurs due to insufficient validation of user-supplied input used in PHP include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized access to system files.

Successful exploitation of this vulnerability allows an attacker to access sensitive information or potentially achieve remote code execution on the underlying server. Given the CVSS score of 8.1, this flaw presents a significant risk to the confidentiality, integrity, and availability of the affected WordPress environment. Organizations using this theme face potential data breaches and total loss of control over the compromised web application.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Melania theme or switch to an alternative theme until a security update is released by ThemeREX.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests containing unusual file paths and PHP extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and restrict access to sensitive system files.

Public Exploit Available: Unknown

The vulnerability in the Melania theme poses a severe security risk that necessitates immediate attention. Until a vendor-supplied patch is confirmed and applied, administrators must prioritize removing the vulnerable component from the production environment to prevent unauthorized access and potential system compromise.