A high-severity local file inclusion vulnerability in the ThemeREX Mandala WordPress theme exposes systems to unauthorized file access and potential remote code execution.

This vulnerability is a local file inclusion flaw caused by improper control of filenames in PHP include statements. An unauthenticated attacker can exploit this via the network to read sensitive files or execute arbitrary code on the hosting server.

Successful exploitation of this vulnerability could lead to a complete compromise of the web application, including unauthorized access to sensitive configuration files, database credentials, and source code. With a CVSS score of 8.1, the risk is high as it permits an unauthenticated actor to gain significant control over the server environment. This poses a severe threat to data confidentiality, integrity, and overall system availability.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or remove the Mandala theme until an official security update is released by ThemeREX.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing path traversal sequences or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the theme directory.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability, administrators must treat this as a critical security risk. We recommend immediate deactivation of the affected theme to prevent potential exploitation while awaiting a vendor-provided fix. Continuous monitoring of the environment is essential until the software is updated or replaced.