A critical Local File Inclusion vulnerability in the ThemeREX Yacht Rental theme allows unauthenticated attackers to potentially read sensitive system files or execute arbitrary code.

This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98. An unauthenticated attacker can manipulate input parameters to include unauthorized local files, which may lead to information disclosure or remote code execution depending on the server configuration.

Successful exploitation of this flaw could result in the unauthorized disclosure of sensitive server-side files, configuration data, or credentials. Given the CVSS score of 8.1, the risk of total system impact is high, potentially leading to a complete compromise of the WordPress installation and its underlying host environment.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Patchstack vulnerability database and the ThemeREX website for security updates, or consider switching to a different theme if an update is not provided promptly.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as "../", or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common directory traversal patterns and unauthorized file inclusion attempts targeting the theme directory.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention, as LFI flaws provide a direct pathway for full system compromise. Administrators must prioritize updating the Yacht Rental theme as soon as a fix is released or implement stringent access controls and WAF rules to mitigate the risk of exploitation.