A local file inclusion vulnerability in the ThemeREX Verse theme allows unauthenticated attackers to potentially read sensitive files or execute code on the hosting server.

This vulnerability involves improper input validation in PHP include or require statements, which allows an unauthenticated attacker to include local files from the server. The flaw stems from CWE-98 and can lead to unauthorized information disclosure or remote code execution depending on the server configuration.

The exploitation of this vulnerability poses a significant risk to organizational data and system integrity. With a CVSS score of 8.1, this flaw is categorized as high severity because it enables an attacker to bypass access controls and potentially gain full control over the web application environment. Unauthorized access to server-side files could lead to the compromise of database credentials, configuration files, and proprietary application logic.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable or remove the ThemeREX Verse theme if it is not strictly required for business operations. If the theme must remain active, contact the vendor for guidance on available security patches or updates.

Proactive Monitoring: Security teams should monitor web server access logs for unusual patterns, such as directory traversal sequences or attempts to access common sensitive file paths like /etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns in HTTP requests.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available.

Given the high CVSS score and the nature of local file inclusion vulnerabilities, this issue should be treated with urgency. Organizations using the ThemeREX Verse theme must conduct an immediate inventory check and restrict access to the affected component until a vendor-supplied update is verified and applied.