This vulnerability in ThemeREX RexCoin (<= 1.2.6) arises from improper validation of filenames in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS v3.1 score is 8.1, indicating high impact with network attack vector, high confidentiality, integrity, and availability impacts, and no required privileges or user interaction.

Successful exploitation could lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute local files on the server. This could result in unauthorized data access, code execution, or denial of service. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying strict input validation to mitigate the risk. Monitor official ThemeREX channels for updates and patches.