A high-severity local file inclusion vulnerability exists in the ThemeREX Miller WordPress theme that could allow an unauthenticated attacker to access sensitive local files.

This vulnerability involves improper control of filenames for include or require statements, categorized as CWE-98. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized data exposure or system compromise.

The vulnerability carries a CVSS score of 8.1, reflecting a significant risk to the confidentiality, integrity, and availability of the host environment. Successful exploitation could allow unauthorized parties to read sensitive configuration files or execute arbitrary code on the web server, leading to full site compromise and potential data breaches.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should immediately deactivate the Miller theme or restrict access to the affected site until a fix is released by ThemeREX.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) attack vectors and directory traversal attempts.

Public Exploit Available: Unknown.

Given the severity of this vulnerability, organizations currently using the ThemeREX Miller theme should prioritize its immediate removal or isolation from the public network. Organizations must remain vigilant for vendor-provided security updates and apply them as soon as they become available to restore secure functionality.