A high-severity Local File Inclusion vulnerability in the ThemeREX Dixon theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This vulnerability is a Local File Inclusion flaw (CWE-98) occurring within the theme's PHP file handling logic. An unauthenticated attacker can exploit this flaw to include unauthorized files, leading to sensitive data exposure or potential remote code execution.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for complete system compromise. Organizations utilizing the affected theme may face significant data breaches, loss of administrative control, and prolonged service disruption.

Immediate Action: Review the official Patchstack advisory for any available theme updates, and if no patch is currently provided, consider deactivating or removing the Dixon theme until a secure version is released.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and malicious file inclusion requests.

Public Exploit Available: Unknown.

Given the High severity of this vulnerability and the potential for full system compromise, administrators must prioritize the security of their WordPress installations. If a vendor update is not yet available, immediate deactivation of the Dixon theme is the most effective way to eliminate the attack surface. Monitor vendor channels closely for the release of a patched version.