A high-severity local file inclusion vulnerability in the ThemeREX Coleo theme exposes the underlying server to potential unauthorized file access and remote code execution.

This vulnerability, classified as CWE-98, allows an unauthenticated attacker to manipulate file paths within include or require statements. By injecting malicious input, an attacker can force the application to include arbitrary local files, potentially leading to sensitive data disclosure or execution of unauthorized code.

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. With a CVSS score of 8.1, the potential for an attacker to read sensitive configuration files or execute arbitrary code could lead to a complete system compromise, resulting in data breaches and operational downtime.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately disable or remove the ThemeREX Coleo theme until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or unexpected file extensions being passed to theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal patterns and attempts to access sensitive system files.

Public Exploit Available: Unknown.

Given the high CVSS score and the critical nature of local file inclusion, this vulnerability must be treated as a priority. Administrators should migrate to an alternative theme or maintain the software in a disabled state until the vendor provides a verified security update that addresses the improper filename control.