CVE-2026-28012: 
WordPress vulnerability analysis and mitigation

CVE-2026-28012 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Gridiron WordPress theme, caused by improper control of filenames in PHP include/require statements (CWE-98). It affects all versions of the Gridiron theme up to and including 1.0.14. The vulnerability was reported on October 4, 2025, and publicly disclosed on March 2–5, 2026. It carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication (Patchstack, Feedly).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized into PHP include or require statements within the Gridiron theme. This allows an unauthenticated remote attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. No user interaction is required, though the attack complexity is rated High, suggesting some precondition or bypass technique is needed (e.g., specific server configuration or path traversal). The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and OWASP Top 10 category A3: Injection (Patchstack, Feedly).

Successful exploitation allows an attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Beyond confidentiality, the vulnerability also carries High integrity and availability impact ratings, meaning attackers may be able to manipulate application behavior or cause service disruption. The scope is limited to the affected system, but credential exposure could enable lateral movement to backend databases or other connected services (Patchstack).

As of the disclosure date, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with no authentication required) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Gridiron theme (version ≤ 1.0.14) via passive scanning tools such as WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate the theme's PHP include/require functionality that accepts user-controlled filename input — typically exposed via a URL query parameter or POST body field processed by the theme's template logic.
3. Craft LFI payload: Construct a request with a path traversal payload targeting sensitive files, e.g., ../../../../wp-config.php or /etc/passwd, injected into the vulnerable parameter.
4. Send the request: Submit the crafted HTTP request to the target WordPress site without any authentication or special privileges.
5. Extract sensitive data: Review the server's response for the contents of the included file — database credentials from wp-config.php can then be used for further database access or privilege escalation (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or form fields; requests returning contents of system files such as /etc/passwd or wp-config.php.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal strings targeting theme-related PHP files; HTTP 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or /etc/shadow correlating with suspicious web requests.
• Application: WordPress error logs showing PHP include/require failures for unusual file paths, indicating probing or failed exploitation attempts.

As of the disclosure date, no official patch from ThemeREX is available for the Gridiron theme. The recommended immediate action is to update the theme to a version newer than 1.0.14 if and when a patched release becomes available. In the interim, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts automatically. Site owners unable to patch should consider disabling the Gridiron theme or restricting access to affected theme functionality, and should consult their hosting provider for additional hardening options (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of WordPress theme and plugin vulnerabilities disclosed that week (Wordfence). Patchstack, the assigning CNA, flagged it as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant independent researcher commentary or social media discussion beyond automated CVE notification channels has been observed.