This vulnerability in ThemeREX Dom (<=1.24) is a Local File Inclusion (LFI) flaw due to improper control of filenames used in PHP include or require statements. An unauthenticated attacker can exploit this to include local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No official patch or remediation guidance is currently available from the vendor or authoritative sources.

Successful exploitation can lead to full compromise of the affected system, including arbitrary code execution, data disclosure, and service disruption. The vulnerability affects confidentiality, integrity, and availability with high severity. Since the flaw is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application, implement web application firewall (WAF) rules to detect and block LFI attempts, and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.