A critical Local File Inclusion vulnerability in the ThemeREX Windsor theme allows unauthenticated attackers to potentially read or execute arbitrary files on the host server.

This flaw is classified as a Local File Inclusion (CWE-98), occurring when the application improperly handles user-supplied input used in PHP include or require statements. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is exploitable by an unauthenticated attacker over the network.

The ability for an attacker to perform Local File Inclusion poses a severe risk to business operations, as it may result in the unauthorized disclosure of sensitive configuration files or the execution of malicious code. Given the high CVSS score of 8.1, this vulnerability could lead to a full system compromise, resulting in significant data breaches and prolonged service outages.

Immediate Action: As no specific patch version is currently identified, users should immediately deactivate or remove the Windsor theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and path traversal attempts directed at the WordPress environment.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a substantial risk to the integrity and confidentiality of the affected WordPress site. Administrators must prioritize the removal of the vulnerable theme or restrict access to the affected components until a vendor-supplied security patch is released and verified. Failure to address this flaw could provide attackers with an unrestricted pathway into the underlying server infrastructure.