This vulnerability (CWE-98) in the LuxMed WordPress theme allows unauthenticated attackers to exploit improper control of filenames used in PHP include or require statements, resulting in Local File Inclusion. The affected versions are up to and including 1.2.2. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet, and no known exploits are reported in the wild.

Successful exploitation could lead to full compromise of the affected WordPress site, including disclosure of sensitive information, modification of data, and denial of service. The vulnerability is exploitable remotely without authentication, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected theme files and consider disabling or removing the LuxMed theme if possible. Monitor official ThemeREX channels for updates and apply patches promptly once released.