A critical local file inclusion vulnerability in the ThemeREX Rhythmo theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This vulnerability is a local file inclusion (CWE-98) flaw where the application fails to properly sanitize user input before passing it to include or require functions. The vulnerability is accessible to unauthenticated attackers over the network.

The ability to include arbitrary local files poses a severe risk to the confidentiality, integrity, and availability of the entire web server. Successful exploitation can lead to the exposure of sensitive configuration files, database credentials, or remote code execution, which may result in full system compromise and significant reputational damage. With a CVSS score of 8.1, this high-severity flaw requires immediate attention to prevent unauthorized access to the underlying infrastructure.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Rhythmo theme or switch to an alternative theme until a vendor-supplied update is verified.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) payloads and directory traversal attempts directed at the WordPress environment.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of local file inclusion, this vulnerability presents a significant risk to any site running the Rhythmo theme. Administrators must prioritize the removal or containment of the affected software immediately. We recommend transitioning to a secure theme version as soon as the vendor releases a fix and verifying that all other WordPress components are up to date to minimize the overall attack surface.