CVE-2026-28013: 
WordPress vulnerability analysis and mitigation

CVE-2026-28013 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Kratz WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Kratz theme up to and including 1.0.12, and was disclosed on March 5, 2026, with the CVE received from Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by CISA-ADP (Patchstack).

The root cause is improper validation and sanitization of filename parameters passed to PHP include/require statements within the Kratz theme (CWE-98). An unauthenticated remote attacker can manipulate these parameters over the network to cause the application to include arbitrary local PHP files, potentially exposing sensitive content or enabling code execution if attacker-controlled files are present on the server. No authentication or user interaction is required, though exploitation is rated as high complexity. The vulnerability was reported by a researcher identified as "Bonds" on October 4, 2025, and published by Patchstack on March 2, 2026 (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials. This could lead to full database compromise, credential theft, and — if combined with a file upload vulnerability or other attacker-controlled file on the server — remote code execution and complete system compromise. The vulnerability has HIGH impact on confidentiality, integrity, and availability (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Kratz theme version 1.0.12 or earlier using tools like WPScan, Shodan, or Google dorks targeting theme-specific files.
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that pass user-supplied input directly to an include or require statement without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated filename parameter (e.g., path traversal sequences such as ../../wp-config.php) targeting the vulnerable endpoint.
4. Retrieve sensitive files: The server processes the crafted filename and includes the specified local file, returning its contents in the HTTP response — exposing credentials or other sensitive data.
5. Escalate if possible: If attacker-controlled files exist on the server (e.g., via a prior file upload), include a PHP web shell to achieve remote code execution and full system compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to Kratz theme PHP files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation.

No official patch from ThemeREX was available as of the disclosure date; the Patchstack database lists "No official patch available" for versions up to and including 1.0.12. Site owners should check for any updated version of the Kratz theme beyond 1.0.12 and apply it immediately if available. As interim mitigations: implement a Web Application Firewall (WAF) — Patchstack has issued a virtual patch/mitigation rule for subscribers — validate and sanitize all user-supplied filename inputs, and disable PHP remote file inclusion (allow_url_include = Off in php.ini). Monitor server logs for suspicious file inclusion patterns (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, indicating broad awareness within the WordPress security community. Patchstack, which discovered and disclosed the vulnerability, has issued a virtual mitigation rule for its users while awaiting an official patch from the theme developer. No significant additional commentary from researchers or media outlets has been identified beyond these standard disclosure channels.