The ThemeREX RexCoin theme contains a critical local file inclusion vulnerability that could allow an unauthenticated attacker to read arbitrary files or execute code on the server.

This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in PHP file inclusion functions. The flaw allows an unauthenticated attacker to manipulate file paths to include local files, potentially leading to information disclosure or remote code execution.

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it grants unauthorized access to sensitive application files and server-side configuration data. With a CVSS score of 8.1, the vulnerability is considered High, as it could lead to full system compromise, loss of data integrity, and significant operational downtime.

Immediate Action: As no official patch version is currently confirmed, administrators should immediately deactivate the RexCoin theme if it is not strictly required for business operations. If the theme is necessary, isolate the affected web server from external networks until a vendor-supplied update is verified and installed.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts.

Public Exploit Available: No (exploit_available: false).

Given the potential for complete system compromise via file inclusion, this vulnerability must be treated with high urgency. Administrators are advised to monitor the official Patchstack database for the release of a security update and apply it immediately upon availability. In the interim, limiting access to the web interface and implementing strict file system permissions are essential to containing the risk.