A critical local file inclusion vulnerability in the ThemeREX Police Department theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This is a local file inclusion (LFI) vulnerability (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can leverage this flaw to include unauthorized files, leading to sensitive data exposure or potential remote code execution.

The exploitation of this vulnerability poses a severe risk to organizational data integrity and server availability. With a CVSS score of 8.1, the high impact on confidentiality, integrity, and availability means an attacker could compromise the entire web application, steal database credentials, or gain a foothold within the hosting environment.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable or remove the ThemeREX Police Department theme until a security update is released by the vendor.

Proactive Monitoring: Review web server error and access logs for requests containing suspicious path traversal patterns or unexpected file inclusions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences or attempts to access restricted PHP files.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high CVSS score and the potential for total system compromise, this vulnerability requires immediate attention. Security teams should prioritize the removal of the vulnerable theme from all production environments until the vendor provides a verified fix, as LFI vulnerabilities are frequently weaponized once technical details become public.