CVE-2026-28021: 
WordPress vulnerability analysis and mitigation

CVE-2026-28021 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Craftis WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Craftis theme up to and including 1.2.8, allowing unauthenticated remote attackers to include and execute arbitrary local PHP files on the server. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 30, 2025, and published by Patchstack on March 2, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Craftis theme (CWE-98). An attacker can manipulate a filename parameter passed to a PHP file inclusion function, causing the server to include arbitrary local files. Exploitation requires no authentication and no user interaction, but is rated as high complexity (AC:H), suggesting some precondition such as specific server configuration or parameter guessing may be required. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to include and render arbitrary local files from the server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials. This can lead to full database compromise, disclosure of application secrets, integrity violations, and potential remote code execution if the attacker can control file content (e.g., via log poisoning). Availability may also be impacted if critical system files are manipulated or exposed (Patchstack).

There is no confirmed public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI, CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Craftis theme version ≤ 1.2.8 using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or use fuzzing tools to locate endpoints where user-supplied input is passed to a PHP include or require statement without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php).
4. Extract sensitive data: Review the server's response for included file contents, such as database credentials from wp-config.php or other configuration files.
5. Escalate (optional): If log poisoning or other file write primitives are available, inject PHP code into a log file and include it via the LFI to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related PHP endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in parameter values.
• Logs: WordPress or web server access logs showing requests with encoded path traversal strings targeting Craftis theme files; repeated 200 responses to unexpected file paths.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP log files via web server processes; new or modified files in the theme directory.
• Process: PHP processes reading files outside the web root or WordPress installation directory.

No official patch from ThemeREX was available as of the publication date (March 2, 2026); users should monitor the WordPress theme repository for an updated version beyond 1.2.8. Patchstack has issued a virtual patch (mitigation rule) for subscribers to block exploitation attempts until an official fix is released. As interim measures, administrators should restrict file permissions, disable unnecessary PHP file inclusion functions where possible, implement WAF rules to detect and block path traversal and LFI patterns, and review access logs for suspicious activity (Patchstack).

Wordfence included CVE-2026-28021 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, which discovered and disclosed the vulnerability, issued a virtual patch for its users and classified it as high priority. No significant independent researcher commentary or broader media coverage has been identified beyond these sources.