A Local File Inclusion vulnerability in the ThemeREX Filmax theme allows unauthenticated attackers to potentially access or execute arbitrary files on the server.

The flaw is a Local File Inclusion (LFI) vulnerability (CWE-98) occurring due to improper handling of filename inputs in include or require statements. This vulnerability is exploitable by unauthenticated remote attackers.

This vulnerability carries a CVSS score of 8.1, reflecting a high severity risk. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary PHP code, leading to a complete compromise of the web application, potential data exfiltration, and significant reputational damage to the organization.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately disable or remove the Filmax theme if it is not essential for business operations.

Proactive Monitoring: Review web server access logs for requests containing suspicious path traversal sequences or attempts to include local system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts, which can help mitigate the risk while awaiting a vendor security update.

Public Exploit Available: Unknown

The presence of a Local File Inclusion vulnerability in a WordPress theme poses a critical risk to the integrity and confidentiality of the hosting environment. Organizations currently using ThemeREX Filmax must prioritize moving to a secure alternative or disabling the theme entirely until the vendor releases a verified patch. Monitoring for unauthorized access attempts is essential until the software is updated.