A high-severity local file inclusion vulnerability in the ThemeREX Muzicon WordPress theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

The flaw is categorized as CWE-98, involving improper control of filenames for include or require statements in PHP, which allows an unauthenticated attacker to perform local file inclusion.

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, credentials, or other internal data residing on the web server. Given the CVSS score of 8.1, the potential for total compromise of confidentiality, integrity, and availability is significant, posing a critical risk to business continuity and data privacy.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or restrict access to the affected site until a fix is released by ThemeREX.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns or unusual file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests.

Public Exploit Available: Unknown

The vulnerability presents a severe risk to the integrity of the hosting environment. Organizations utilizing the Muzicon theme should treat this as a high-priority incident and move to mitigate the exposure by disabling the theme or implementing robust perimeter filtering until the vendor provides a formal security update.