A critical local file inclusion vulnerability in the ThemeREX Run Gran theme could allow unauthenticated attackers to execute arbitrary code or access sensitive system files.

This flaw is caused by improper control of filenames in PHP include or require statements, categorized as CWE-98. An unauthenticated attacker can exploit this via the run-gran component to perform local file inclusion, potentially leading to unauthorized data access or remote code execution.

The exploitation of this vulnerability poses a severe risk to organizational data integrity and system availability. Given the CVSS score of 8.1, the potential for an unauthenticated attacker to read sensitive configuration files or execute arbitrary scripts on the underlying server could result in full site compromise, data breaches, and significant operational disruption.

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately disable or remove the affected Run Gran theme from all WordPress installations until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing directory traversal patterns or unexpected file paths directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file inclusion attempts and directory traversal payloads to provide virtual patching until the theme is updated.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk due to the potential for unauthenticated remote exploitation. It is imperative that administrators identify all instances of the ThemeREX Run Gran theme and deactivate them immediately to prevent unauthorized access. Monitor vendor communications closely for the release of a security patch and perform a thorough audit of the environment once the theme is updated or replaced.