The ThemeREX Bazinga WordPress theme contains a critical local file inclusion vulnerability that allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

This vulnerability, classified as CWE-98, occurs when the theme fails to properly sanitize user input before passing it to file inclusion functions. An unauthenticated attacker can exploit this flaw to perform local file inclusion, potentially leading to full system compromise.

A successful exploitation of this local file inclusion vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. With a CVSS score of 8.1, the vulnerability is categorized as High, as it allows attackers to bypass security controls to access sensitive server files or execute malicious PHP code, which may result in full site takeover and significant data breach.

Immediate Action: Since a specific patch is not confirmed in the available data, administrators should immediately deactivate or remove the Bazinga theme if it is not business-critical. Users should monitor the vendor website for the release of version 1.1.10 or higher.

Proactive Monitoring: Review web server error logs and access logs for suspicious patterns, such as directory traversal attempts or requests for non-existent PHP files in theme directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to block directory traversal sequences, such as dot-dot-slash patterns, to mitigate potential exploitation attempts.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of local file inclusion flaws, immediate action is required to protect the integrity of the hosting environment. Organizations currently utilizing the Bazinga theme should prioritize its removal or restriction until a secure version is verified and deployed.