The ThemeREX Marcell theme contains a local file inclusion vulnerability that could allow an unauthenticated attacker to compromise system files or execute arbitrary code.

This vulnerability, categorized as CWE-98, arises from improper handling of filenames in include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to full system compromise.

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation could allow unauthorized access to sensitive configuration files, source code, or internal data, leading to severe reputational damage and potential loss of data integrity.

Immediate Action: Since a specific patch version is not currently identified, users should review the vendor advisory and monitor for updates to the Marcell theme, or consider disabling the theme until a secure version is released.

Proactive Monitoring: Security teams should examine server access logs for suspicious patterns, such as directory traversal characters or unexpected file path requests directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unauthorized file inclusion requests.

Public Exploit Available: No (exploit_available: false).

Given the high severity of this file inclusion flaw, administrators must treat this as a significant security risk. We recommend auditing current installations of the ThemeREX Marcell theme and ensuring that the site is protected by a WAF while awaiting a formal patch from the vendor.