CVE-2026-28010: 
WordPress vulnerability analysis and mitigation

CVE-2026-28010 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Scientia WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Scientia theme up to and including 1.2.4, and can be exploited by unauthenticated remote attackers. The vulnerability was published on March 2–5, 2026, with discovery credited to researcher 'Bonds' and disclosure coordinated by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Scientia theme (CWE-98), allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. This is a network-accessible attack vector requiring no authentication and no user interaction, though it has high attack complexity. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and classified under OWASP Top 10 A3: Injection. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), leading to full database compromise. The vulnerability has high impact on confidentiality, integrity, and availability, meaning an attacker could read sensitive data, modify site content, or disrupt service. In a worst-case scenario, if combined with a file upload vulnerability, LFI could be escalated to remote code execution (Patchstack).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

No official patch from ThemeREX is currently available for the Scientia theme. Organizations should immediately update to a version newer than 1.2.4 if one becomes available, or consider replacing the theme with a supported alternative. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Additional mitigations include deploying a Web Application Firewall (WAF) with LFI detection rules, restricting PHP's allow_url_include and reviewing file permissions, and disabling dynamic file inclusion if not required by the application (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, indicating it received standard industry tracking attention. No notable individual researcher commentary or significant social media discussion has been identified beyond routine CVE announcement channels.