The ThemeREX Good Homes theme contains a critical Local File Inclusion vulnerability that could allow an unauthenticated attacker to access or execute arbitrary files on the server.

This vulnerability, categorized as CWE-98, stems from the improper handling of user-supplied input in include or require statements. An unauthenticated attacker can manipulate the filename parameter to perform Local File Inclusion, potentially leading to unauthorized data exposure or remote code execution.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for full system compromise. Unauthorized access to sensitive configuration files, source code, or internal data could result in significant reputational damage and regulatory non-compliance.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Good Homes theme if it is not business-critical. If the theme is required, restrict access to the affected site and monitor vendor channels for the release of a security update.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion patterns targeting PHP include functions.

Public Exploit Available: Unknown.

Given the potential for total system impact, this vulnerability must be treated with high urgency. Administrators are advised to prioritize the removal or containment of the affected theme until a vendor-supplied update is confirmed and verified. Failure to address this flaw could lead to complete server compromise by unauthenticated remote actors.