The ThemeREX Save Life theme is vulnerable to Local File Inclusion, which may allow an unauthenticated attacker to read sensitive files on the server.

The theme contains an improper control of filenames for include or require statements, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to perform Local File Inclusion (LFI) by manipulating input parameters.

A successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, source code, or credentials stored on the web server. With a CVSS score of 8.1, the risk is classified as High due to the potential for full confidentiality, integrity, and availability impact, which could result in a complete compromise of the affected web application environment.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable the Save Life theme or switch to a secure alternative until an official update is released by ThemeREX.

Proactive Monitoring: Review web server access and error logs for suspicious directory traversal patterns, such as sequences containing '../' or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters or unexpected file path inclusions targeting the theme directory.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the High severity of this vulnerability, immediate defensive action is required. Organizations using the ThemeREX Save Life theme must prioritize removing or securing the component to prevent potential unauthorized access. Monitoring for signs of attempted exploitation remains a critical secondary measure while awaiting a vendor-supplied resolution.