A high-severity local file inclusion vulnerability in the ThemeREX Dr.Patterson WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

The theme fails to properly sanitize user-supplied input used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw can be triggered by unauthenticated remote attackers.

Successful exploitation allows an attacker to include arbitrary files on the server, potentially leading to the exposure of sensitive configuration files or the execution of malicious code. Given the CVSS score of 8.1, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the host system. Such compromises often lead to full site takeover and unauthorized access to backend databases.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate the Dr.Patterson theme or restrict access to the affected site until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack payloads and directory traversal attempts.

Public Exploit Available: No (exploit_available: false).

The vulnerability in ThemeREX Dr.Patterson presents a severe security risk due to the potential for unauthorized file access and remote code execution. Security teams must prioritize monitoring for anomalous traffic and prepare to update the theme as soon as the vendor releases a fix. Until that time, isolating the affected application remains the most effective strategy to prevent compromise.