The ThemeREX Happy Baby theme contains a critical Local File Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary code or access sensitive files on the server.

This vulnerability is a Local File Inclusion (CWE-98) flaw occurring within the theme's PHP include/require logic. It allows an unauthenticated attacker to manipulate file paths, potentially resulting in unauthorized file access or remote code execution.

The CVSS score of 8.1 indicates a high severity risk that could lead to full system compromise. Successful exploitation allows an attacker to read sensitive configuration files or execute arbitrary scripts, leading to complete data exfiltration and potential loss of control over the WordPress installation.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable or uninstall the Happy Baby theme until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious PHP include parameters.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue represents a significant threat to server integrity. We strongly recommend removing the affected theme from production environments immediately and replacing it with a secure alternative, as no vendor-provided patch has been verified at this time.