CVE-2026-28007: 
WordPress vulnerability analysis and mitigation

CVE-2026-28007 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Coinpress WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Coinpress theme through and including version 1.0.14, and can be exploited by unauthenticated remote attackers. The vulnerability was published on March 2–5, 2026, with Patchstack credited as the assigning authority and researcher "Bonds" credited with discovery. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Coinpress theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files on the server. Because no authentication is required and user-supplied input is not properly validated or sanitized before being passed to file inclusion functions, an unauthenticated remote attacker can craft a malicious HTTP request to trigger the inclusion of sensitive server-side files. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. Patchstack has issued a virtual patch (mitigation rule) to block exploitation attempts while no official patch from the developer is available (Patchstack).

Successful exploitation allows an attacker to include and read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability carries high confidentiality, integrity, and availability impacts — an attacker who gains database credentials or can execute included PHP files may achieve complete server compromise, unauthorized data access, and service disruption (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053% (0.000530), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Coinpress theme (version ≤ 1.0.14) via web crawlers, Shodan, WPScan, or by checking theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed unsanitized to include/require statements.
3. Craft malicious request: Construct an HTTP request (GET or POST) that supplies a manipulated filename value (e.g., path traversal sequences such as ../../../../wp-config.php) to the vulnerable parameter.
4. Trigger file inclusion: Submit the crafted request to the target WordPress site; if successful, the server will include and output the contents of the targeted local file.
5. Extract sensitive data: Review the server response for sensitive content such as database credentials from wp-config.php, which can then be used for further lateral movement or full site compromise (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields targeting the Coinpress theme endpoints.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns or references to sensitive files (e.g., wp-config.php, /etc/passwd) in parameter values; HTTP 200 responses to such requests may indicate successful inclusion.
• File System: Unexpected new files or web shells written to the WordPress theme or upload directories if the LFI is chained with a file upload vulnerability.
• Application: Unusual database connection errors or authentication failures following exploitation, potentially indicating credential harvesting from wp-config.php (Patchstack).

No official patch from the ThemeREX Coinpress developer is currently available for versions through 1.0.14. Patchstack has issued a virtual patch/mitigation rule for Patchstack-protected sites to block exploitation attempts in the interim. Administrators should consider replacing or disabling the theme until an official fix is released, restricting file inclusion via PHP configuration (e.g., setting open_basedir), and ensuring allow_url_include is disabled. Monitoring application logs for path traversal patterns and implementing a web application firewall (WAF) rule are also recommended interim measures (Patchstack).

Wordfence included CVE-2026-28007 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, which discovered and disclosed the vulnerability, classified it as high priority and noted the risk of mass-exploit campaigns targeting this class of vulnerability. No significant additional vendor statements or notable researcher commentary beyond these sources have been identified.