The ThemeREX Ozisti WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary code or access sensitive system files.

This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements. An unauthenticated attacker can manipulate the input to perform Local File Inclusion, potentially resulting in full system compromise.

A successful exploit of this vulnerability allows for unauthorized file access and potential remote code execution. Given the CVSS score of 8.1, this is a high-severity issue that could lead to complete system compromise, data theft, and loss of service integrity. Organizations using this theme are at significant risk of unauthorized access to sensitive configuration files or application data.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Ozisti theme until a security update is released by ThemeREX.

Proactive Monitoring: Monitor server access logs for unusual requests containing directory traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts.

Public Exploit Available: Unknown.

Given the potential for complete system compromise via Local File Inclusion, this vulnerability presents a high risk to the availability and confidentiality of the host environment. Administrators must prioritize the removal or restriction of the affected theme immediately. Continue to monitor the vendor advisory for the release of a patched version and apply it as soon as it becomes available.