A high-severity Local File Inclusion vulnerability in the ThemeREX Asia Garden theme could allow an unauthenticated attacker to access sensitive local files or execute arbitrary code.

The flaw is categorized as CWE-98, involving improper control of filenames used in include or require statements. An unauthenticated attacker can leverage this weakness to perform Local File Inclusion, potentially accessing unauthorized files on the server.

Successful exploitation of this vulnerability poses a significant risk to data confidentiality and integrity. An attacker could read sensitive configuration files, including database credentials, or potentially achieve remote code execution, leading to full site compromise and severe reputational damage. The CVSS score of 8.1 reflects the high potential for total system impact and unauthorized data access.

Immediate Action: Since a specific patched version is not yet confirmed, administrators should immediately deactivate or remove the Asia Garden theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as directory traversal sequences or attempts to include unexpected local files via URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and directory traversal attempts directed at the theme directory.

Public Exploit Available: Unknown.

Given the high impact of this vulnerability, immediate defensive action is required. Organizations using the ThemeREX Asia Garden theme must monitor the vendor's security disclosures for a patch release and apply it without delay. Until such a fix is verified, removing the theme is the most effective way to eliminate the risk of exploitation.