A critical local file inclusion vulnerability in the ThemeREX Aqualots WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can supply malicious input to the vulnerable parameter to access or execute arbitrary files on the local filesystem.

The ability for an unauthenticated attacker to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the affected system. Exploitation could lead to the exposure of sensitive configuration files, database credentials, or remote code execution, which may result in full system compromise and significant reputational damage. The CVSS score of 8.1 reflects the high severity of this potential impact.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the Aqualots theme until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences or attempts to include unauthorized local files.

Public Exploit Available: Unknown.

Given the high severity of this local file inclusion vulnerability, security teams must treat this as an urgent matter. Immediate deactivation of the vulnerable theme is the safest course of action until an official patch is provided by ThemeREX. Ensure that all web server logs are reviewed for evidence of past exploitation attempts.