CVE-2026-28018: 
WordPress vulnerability analysis and mitigation

CVE-2026-28018 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Global Logistics WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Global Logistics theme through version 3.20 and was published on March 2–5, 2026, with discovery credited to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who reported it on September 30, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers under high complexity conditions (Patchstack, Feedly).

The root cause is improper validation and control of filenames used in PHP include/require statements within the Global Logistics WordPress theme (CWE-98), which allows an attacker to manipulate file path parameters to include arbitrary local files from the server's filesystem. The attack vector is network-based, requires no authentication or user interaction, but does involve high attack complexity, suggesting some precondition such as specific server configuration or parameter guessing may be required. The vulnerability maps to CAPEC-193 (PHP Remote File Inclusion) and is classified under OWASP Top 10 A3: Injection. No public proof-of-concept exploit code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files from the web server, including sensitive configuration files such as wp-config.php, which contains database credentials, authentication keys, and API secrets. This could lead to complete compromise of the WordPress installation, unauthorized database access, and potential lateral movement to the underlying server infrastructure. Confidentiality, integrity, and availability are all rated as HIGH impact (Patchstack, Feedly).

As of the time of reporting, no public proof-of-concept exploit exists and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic size (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Global Logistics theme version 3.20 or earlier using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters that are passed unsanitized to PHP include() or require() statements.
3. Craft malicious request: Construct an HTTP request that manipulates the vulnerable file path parameter to traverse the directory structure (e.g., using ../ sequences) and point to a sensitive local file such as /etc/passwd or wp-config.php.
4. Exfiltrate sensitive data: Submit the crafted request to the target server and capture the file contents returned in the HTTP response, extracting credentials, API keys, or other sensitive configuration data.
5. Escalate access: Use obtained database credentials or API keys to gain further access to the WordPress admin panel, database, or connected services, enabling full site compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related PHP endpoints containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files like wp-config.php or /etc/passwd.
• Logs: Web server access logs (Apache/Nginx) showing requests with path traversal patterns targeting theme files; PHP error logs indicating failed or successful file inclusion of unexpected paths.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files not normally accessed by the web process.
• Process: Unusual PHP process activity reading files outside the WordPress web root directory.

As of the disclosure date, no official patch from ThemeREX is available for the Global Logistics theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) updating the theme to a version newer than 3.20 if/when a patch becomes available; (2) temporarily disabling the theme and switching to an alternative; (3) deploying Web Application Firewall (WAF) rules to detect and block path traversal and file inclusion attempts; and (4) restricting filesystem permissions to limit web server access to sensitive files (Patchstack, Feedly).

Wordfence included CVE-2026-28018 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it among notable disclosures for that week. Patchstack, the assigning CNA, classified it as high priority and noted the vulnerability class is commonly leveraged in mass-exploit campaigns against WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond these standard vulnerability tracking publications (Wordfence, Patchstack).