A critical local file inclusion vulnerability in the ThemeREX WealthCo theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

This vulnerability is a local file inclusion (CWE-98) flaw where the theme fails to properly validate user-supplied input before passing it to include or require statements. An unauthenticated attacker can exploit this to access or execute arbitrary files on the server.

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.1, the high potential for full system compromise and unauthorized data access poses a significant threat to organizational confidentiality and integrity.

Immediate Action: As no official patch is currently confirmed, users should immediately deactivate and remove the WealthCo theme until a vendor-supplied update is available.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing directory traversal patterns or unusual file paths targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common local file inclusion signatures and unauthorized access attempts to PHP files.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate action to prevent unauthorized access to the underlying server infrastructure. Until the vendor releases a secure update, the most effective mitigation is to discontinue the use of the WealthCo theme. Organizations should prioritize removing this component to eliminate the attack surface entirely.