The ThemeREX Bassein theme is vulnerable to local file inclusion, which could allow an unauthenticated attacker to access or execute sensitive files on the server.

The vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can manipulate input parameters to include arbitrary local files, leading to potential information disclosure or remote code execution.

Successful exploitation of this vulnerability allows an attacker to read sensitive files on the host server, which may include configuration files, database credentials, or application source code. Given the CVSS score of 8.1, this flaw poses a high risk to data confidentiality and system integrity, potentially leading to a full compromise of the WordPress environment.

Immediate Action: As no specific patch version is currently identified, administrators should monitor the vendor website for security updates and apply them immediately upon release. If an update is not yet available, consider disabling the Bassein theme until a fix is provided.

Proactive Monitoring: Review web server access logs for suspicious patterns involving directory traversal characters or unexpected file path inclusions. Monitor for unauthorized access attempts directed at sensitive system configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal or file inclusion attempts. Ensure the web server process runs with the least privilege necessary to limit the impact of potential file access.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk to any site utilizing the Bassein theme. Organizations should prioritize patching as soon as the vendor releases a secure version and maintain strict monitoring of the affected environment until remediation is confirmed.