CVE-2026-28019: 
WordPress vulnerability analysis and mitigation

CVE-2026-28019 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Manoir WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Manoir theme through version 1.11 and was published on March 2–5, 2026, with discovery credited to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who reported it on September 30, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction, though with high attack complexity (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Manoir theme (CWE-98), allowing an attacker to manipulate file path inputs to include arbitrary local files on the server. The attack vector is network-based, requiring no privileges or user interaction, but is classified as high complexity, suggesting specific conditions or non-default configurations must be met for exploitation. An attacker can leverage this to read sensitive local files such as configuration files containing database credentials or other server-side secrets. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and was assigned by Patchstack (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary local files on the web server, resulting in high confidentiality, integrity, and availability impacts. Sensitive files such as WordPress configuration files (wp-config.php) containing database credentials could be exposed, potentially enabling complete database takeover. Depending on server configuration, this could also facilitate further lateral movement within the hosting environment (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-28019. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Manoir theme (version ≤ 1.11) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Analyze the theme's PHP code or publicly available source to locate file inclusion points where user-controlled input is passed to include() or require() without adequate sanitization.
3. Craft malicious request: Send a crafted HTTP request (GET or POST) to the vulnerable endpoint, manipulating the filename parameter to reference a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Extract sensitive data: Review the HTTP response for the contents of the included file, which may expose database credentials, secret keys, or other configuration data.
5. Escalate access: Use extracted credentials (e.g., database username/password from wp-config.php) to access the database directly or escalate privileges within the WordPress installation (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded or decoded directory traversal patterns targeting theme-related PHP files; HTTP 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process.
• Process: Web server process (e.g., Apache, Nginx, PHP-FPM) reading files outside the WordPress web root directory.

As of the disclosure date, no official patch has been released by ThemeREX for the Manoir theme. Users are advised to immediately upgrade to a version newer than 1.11 if one becomes available, or consider disabling or replacing the theme in the interim. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Additional hardening measures include implementing strict input validation for file inclusion parameters, applying least-privilege file system permissions, and monitoring web application logs for path traversal attempts (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of March 2–8, 2026, indicating it received standard industry tracking attention. No notable individual researcher commentary or significant social media discussion has been identified beyond routine CVE announcement channels. Patchstack, as the assigning authority, flagged it as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites (Wordfence, Patchstack).