A critical local file inclusion vulnerability in the ThemeREX Artrium theme allows unauthenticated attackers to potentially access sensitive files or execute arbitrary code on the server.

The vulnerability is a Local File Inclusion (LFI) flaw stemming from improper control of filenames used in PHP include statements. An unauthenticated attacker can leverage this weakness to include unauthorized files, leading to potential information disclosure or remote code execution depending on the server configuration.

The exploitation of this vulnerability poses a severe risk to organizational data and system integrity. With a CVSS score of 8.1, this high-severity flaw could allow an attacker to read sensitive configuration files, including database credentials, or achieve remote code execution, which may lead to a total compromise of the affected web server and its hosted content.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Artrium theme if it is not mission-critical. If the theme must remain active, contact the vendor for an urgent security update or identify an alternative theme.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access common configuration files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized file inclusion attempts.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the high CVSS score and the nature of local file inclusion vulnerabilities, this issue should be treated as a priority for remediation. Organizations using the Artrium theme must take immediate steps to restrict access or remove the vulnerable component until a secure version is provided by the vendor.