A critical local file inclusion vulnerability in the ThemeREX S.King theme exposes systems to unauthorized file access and potential remote code execution.

This is a local file inclusion (LFI) flaw, categorized as CWE-98, arising from improper control of filenames used in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform local file inclusion allows an attacker to read sensitive server files, including configuration files or credentials, and potentially execute arbitrary code on the underlying server. Given the CVSS score of 8.1, this represents a high risk that could lead to full system compromise, significant data exfiltration, and severe reputational damage.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the S.King theme if it is not business-critical. If the theme must remain active, ensure that all directory permissions are restricted and the web server is configured to prevent directory traversal.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule designed to detect and block common file inclusion payload patterns and unauthorized attempts to access sensitive system files.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators must prioritize the containment of this threat by restricting access to the vulnerable theme or implementing robust perimeter filtering until a formal security update is provided by the vendor.