A critical Local File Inclusion vulnerability in the ThemeREX Eject theme allows unauthenticated attackers to potentially read sensitive system files or execute arbitrary code.

This vulnerability, classified as CWE-98, occurs because the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can manipulate this input to include local files, leading to information disclosure or potential remote code execution.

The ability to include arbitrary local files poses a significant risk to data confidentiality and system integrity. Successful exploitation could allow an attacker to read configuration files containing database credentials or sensitive environment variables, ultimately leading to full site compromise. With a CVSS score of 8.1, this high-severity flaw requires urgent attention to prevent unauthorized access and potential data exfiltration.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately disable or remove the Eject theme if it is not essential to business operations.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns, such as sequences like "../" or null byte injections, directed at the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule specifically configured to block directory traversal attempts and restrict access to sensitive system files from the web server context.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue presents a substantial risk to any WordPress environment utilizing the Eject theme. Security teams must prioritize the deactivation of the affected component until a vendor-supplied update is verified and applied. Continuous monitoring of server integrity is advised until the environment is fully remediated.