A critical local file inclusion vulnerability in the ThemeREX Gamezone theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

This vulnerability is a local file inclusion flaw (CWE-98) where an unauthenticated attacker can manipulate input parameters to include unauthorized files on the server. The vulnerability exists because the theme fails to validate user-supplied input before passing it to include or require functions in PHP.

Successful exploitation of this vulnerability can result in the exposure of sensitive configuration files, source code, or internal data. Given the CVSS score of 8.1, the potential for unauthorized file access represents a significant risk to the confidentiality and integrity of the hosting server and the WordPress application.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or uninstall the Gamezone theme if it is not essential for business operations. Monitor the vendor website for the release of a security update that addresses this file inclusion flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or references to unexpected system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the WordPress installation.

Public Exploit Available: No (exploit_available: false).

Given the severity of potential local file inclusion, administrators should prioritize securing the affected environment immediately. If an update is not yet provided by ThemeREX, restricting file access and implementing strict input validation via a WAF is essential to mitigate the risk of unauthorized server-side file access.