A local file inclusion vulnerability in the ThemeREX Mahogany theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

This flaw is a local file inclusion (LFI) vulnerability stemming from CWE-98, where the application fails to properly sanitize user input used in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

The vulnerability carries a CVSS score of 8.1, indicating a high level of severity due to the potential for full compromise of the application server. Successful exploitation allows an attacker to read sensitive configuration files or execute arbitrary PHP code, leading to complete data exfiltration, service disruption, or total system takeover.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or uninstall the Mahogany theme if it is not strictly required. If the theme must remain in use, contact the vendor for an urgent security update or migrate to a secure alternative.

Proactive Monitoring: Monitor server access logs for unusual URL patterns, specifically those containing directory traversal sequences like dot-dot-slash (../) or requests targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common path traversal and local file inclusion attack vectors targeting PHP applications.

Public Exploit Available: Unknown

Given the high severity and the potential for full system compromise, organizations currently running the Mahogany theme should treat this as a critical priority. Until the vendor releases a definitive security patch, removing the theme is the only effective way to eliminate the risk of unauthorized file access and potential remote code execution.