A Local File Inclusion vulnerability in the ThemeREX Coinpress WordPress theme allows unauthenticated attackers to read sensitive files or potentially execute arbitrary code on the server.

This vulnerability is a Local File Inclusion (CWE-98) flaw where an unauthenticated attacker can manipulate the file path input to include unintended local files, leading to sensitive data exposure or potential remote code execution.

Successful exploitation of this vulnerability could allow an attacker to read sensitive configuration files or execute malicious PHP code, resulting in total system compromise. Given the CVSS score of 8.1, this is a high severity issue that carries significant risk of data exfiltration and unauthorized administrative access to the underlying WordPress environment.

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately deactivate the Coinpress theme if not strictly required, or implement strict file system permissions to limit the web server's ability to access sensitive files.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common file inclusion payloads.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, organizations currently utilizing the Coinpress theme must prioritize immediate risk mitigation. Ensure the theme is updated if a vendor release becomes available, and maintain a posture of least privilege for the web server user account to contain the impact of any potential exploitation.