The ThemeREX Vapester WordPress theme is susceptible to a local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive files or execute code on the host server.

This vulnerability, classified as CWE-98, occurs due to improper control of filenames used in include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Successful exploitation of this vulnerability poses a severe risk to organizational data and system integrity. By reading arbitrary files from the server, an attacker may extract configuration files, database credentials, or sensitive application source code, which could facilitate further compromise of the entire web environment. Given the CVSS score of 8.1, the vulnerability is classified as High and requires immediate attention to prevent total system compromise.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Vapester theme if it is not business-critical. If the theme is required, restrict access to the web server and monitor for suspicious file inclusion patterns until an official security update is released by ThemeREX.

Proactive Monitoring: Review web server access logs for unusual requests containing directory traversal sequences or attempts to include non-PHP files. Monitor for spikes in unauthorized error codes that may suggest automated scanning for this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal and local file inclusion attempts. Ensure the PHP configuration (php.ini) has allow_url_include disabled to mitigate the impact of remote file inclusion vectors.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for WordPress installations using the Vapester theme. Administrators must prioritize the containment of this threat by disabling the affected component until a vendor-supplied update is verified and applied. Maintaining a robust backup and monitoring strategy is essential while awaiting a formal patch.