The ThemeREX Nelson WordPress theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to access sensitive files on the host server.

This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98, where input used in PHP include or require statements is not properly sanitized. An unauthenticated attacker can leverage this to include arbitrary local files, potentially leading to unauthorized data disclosure or code execution.

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation could allow an attacker to read sensitive configuration files, credentials, or source code, which may lead to a full system compromise, loss of data integrity, and significant reputational damage.

Immediate Action: Check the official ThemeREX or Patchstack advisory for the latest security update and apply it immediately to address the inclusion flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access restricted PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns or unexpected file paths targeting the theme directory.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full system compromise, administrators should prioritize this update. If a patch is not yet available from the vendor, consider disabling the Nelson theme until a secure version is released to prevent potential exploitation of this critical flaw.