The ThemeREX Daiquiri theme is vulnerable to Local File Inclusion, which could allow unauthenticated attackers to access sensitive system files or execute malicious code.

The theme suffers from an improper control of filenames for include statements (CWE-98), allowing an unauthenticated attacker to perform Local File Inclusion. This flaw enables the inclusion of arbitrary PHP files from the local server filesystem.

Successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the host environment. With a CVSS score of 8.1, the high severity reflects the potential for total system compromise, including unauthorized access to sensitive application data and the ability for an attacker to execute arbitrary commands under the context of the web server.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Daiquiri theme if it is not business-critical or switch to a secure alternative.

Proactive Monitoring: Review web server access and error logs for suspicious path traversal patterns or unexpected file inclusion requests targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal and file inclusion attack strings to mitigate the risk until a vendor update is applied.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the high CVSS score and the nature of the vulnerability, immediate action is required to prevent potential compromise. Organizations currently utilizing the ThemeREX Daiquiri theme must prioritize deactivation or the implementation of strict WAF filtering until the vendor releases a secure update to resolve the file inclusion flaw.