The ThemeREX Dermatology Clinic theme contains a Local File Inclusion vulnerability that could allow an unauthenticated attacker to compromise system files or execute arbitrary code.

This flaw, categorized as CWE-98, involves the improper control of filenames for include or require statements in PHP code, allowing an unauthenticated attacker to perform Local File Inclusion.

A successful exploit poses a significant risk to the integrity and confidentiality of the host environment. By including local files, an attacker may be able to read sensitive system configuration files or potentially achieve remote code execution, leading to a complete system compromise. With a CVSS score of 8.1, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to backend infrastructure.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Dermatology Clinic theme until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and directory traversal attempts directed at the theme directory.

Public Exploit Available: No — exploit_available (unknown).

Given the potential for full system compromise, this vulnerability represents a significant risk to WordPress installations utilizing the Dermatology Clinic theme. Organizations must prioritize the deactivation of this component until the vendor provides a verified fix. Continuous monitoring of server logs is essential to detect any attempts to leverage this flaw while awaiting remediation.