A high-severity local file inclusion vulnerability in the ThemeREX MCKinney's Politics theme poses a significant risk of unauthorized file access and potential system compromise.

This vulnerability is a Local File Inclusion (LFI) flaw resulting from improper control of filenames used in include or require statements. An unauthenticated attacker can exploit this weakness to access sensitive files on the server.

Successful exploitation allows an attacker to read arbitrary files from the server, which may include configuration files, credentials, or sensitive application code. Given the CVSS score of 8.1, this vulnerability poses a high risk to data confidentiality and integrity, potentially leading to a full system compromise and significant reputational damage.

Immediate Action: Since no patch is explicitly confirmed, users should immediately deactivate or remove the MCKinney's Politics theme until a security update is released by ThemeREX.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious path traversal patterns, such as sequences like "../" or attempts to access common system files like /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI payloads and directory traversal attempts targeting WordPress theme directories.

Public Exploit Available: No (Exploit available: false)

Given the potential for unauthorized data disclosure and the high severity of the vulnerability, administrators must prioritize the removal of the vulnerable theme. Organizations should perform a thorough audit of all active WordPress themes and implement strict file permission policies to limit the potential impact of file inclusion vulnerabilities.