ThemeREX Dixon versions up to 1.4.2.1 suffer from improper control of filenames in PHP include/require statements, causing a PHP Local File Inclusion vulnerability. This flaw allows an attacker to include local files on the server, which can lead to execution of arbitrary code or disclosure of sensitive information. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. An attacker may execute arbitrary code or access sensitive files by including local files via the vulnerable PHP include/require statements. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying other protective controls such as web application firewalls to mitigate potential exploitation.