A high-severity local file inclusion vulnerability in the ThemeREX Legal Stone theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary PHP code.

The flaw is categorized as a local file inclusion (CWE-98) issue, where the application fails to properly sanitize user-supplied input used in include statements. An unauthenticated attacker can leverage this weakness to include malicious files from the server, leading to full compromise of the application.

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for an attacker to gain unauthorized access to sensitive configuration files, database credentials, or execute arbitrary code on the underlying server. Such a breach could result in total system compromise and severe reputational damage.

Immediate Action: Since no official patch is currently confirmed as available, administrators should immediately deactivate or uninstall the Legal Stone theme if it is not strictly necessary for business operations. If the theme must remain active, ensure strict access controls are in place and monitor the environment for suspicious file access patterns.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward the theme's directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and directory traversal attempts targeting the WordPress installation.

Public Exploit Available: No — exploit_available (unknown).

Given the critical nature of local file inclusion vulnerabilities, administrators must treat this threat with high urgency. If an update becomes available, it should be applied immediately to neutralize the risk of unauthorized file access and potential remote code execution. In the interim, isolating the affected system or removing the vulnerable theme is the most effective way to secure your infrastructure against this threat.