The ThemeREX Edge Decor theme for WordPress contains a critical local file inclusion vulnerability that could allow an unauthenticated attacker to compromise server-side data.

This vulnerability is a local file inclusion flaw caused by improper control of filenames in PHP include or require statements. An unauthenticated attacker can exploit this to read arbitrary files from the server, potentially leading to full system compromise depending on the server configuration.

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the hosting environment. By accessing sensitive configuration files or source code, an attacker could gain further unauthorized access to the application or database, resulting in data breaches and potential service disruption. With a CVSS score of 8.1, this flaw represents a high risk that requires immediate attention to prevent unauthorized system access.

Immediate Action: Since no specific patch version is currently listed, administrators should immediately deactivate the Edge Decor theme until a security update is released by the vendor.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward theme-related files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the potential for total impact, organizations currently utilizing the Edge Decor theme must treat this as a high-priority incident. Deactivation of the theme is the safest course of action until the vendor provides a verified security update, as manual remediation of theme source code is prone to error and may be reverted by future updates.