A high-severity local file inclusion vulnerability in the ThemeREX Legrand theme for WordPress could allow unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98. The software fails to properly sanitize user-supplied input used in PHP include or require statements, allowing an unauthenticated attacker to include unauthorized files from the local filesystem.

The CVSS score of 8.1 indicates a high risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to full server compromise, unauthorized access to sensitive configuration files or credentials, and potential remote code execution, posing a significant threat to organizational data security.

Immediate Action: Since a specific patch version is not currently identified, administrators should verify if the theme developer has released an update and apply it immediately. If no update is available, consider switching to a different theme or disabling the Legrand theme until a vendor-supplied fix is provided.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or references to sensitive files like etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests directed at the theme directory.

Public Exploit Available: No.

Given the high CVSS score and the critical nature of local file inclusion flaws, organizations should prioritize auditing their WordPress installations for the presence of the Legrand theme. If identified, treat the system as high risk and implement strict access controls and WAF protections until a formal vendor patch is confirmed and applied.