CVE-2026-28027: 
WordPress vulnerability analysis and mitigation

CVE-2026-28027 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Kayon WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Kayon theme through version 1.3, with no official patch available as of the time of disclosure. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 30, 2025, and published by Patchstack on March 2, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The vulnerability stems from improper validation and sanitization of user-supplied input used in PHP include/require statements within the Kayon theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (per the CVSS vector), but no authentication or user interaction is needed. No public proof-of-concept exploit code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and render arbitrary local PHP files from the server's filesystem, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), leading to full database compromise. The vulnerability carries high impact across confidentiality, integrity, and availability — attackers could read sensitive data, execute malicious PHP code already present on the server, and disrupt site operations. In a shared hosting environment, this could also facilitate lateral movement to other hosted sites (Patchstack).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with high CVSS scores) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Kayon theme version ≤ 1.3 via tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that accept user-controlled input for file inclusion (e.g., a template or page parameter passed to an include/require call).
3. Craft LFI payload: Construct an HTTP request with a manipulated parameter value pointing to a sensitive local file, such as ../../../../wp-config.php or /etc/passwd, using path traversal sequences.
4. Send the request: Submit the crafted request to the vulnerable endpoint on the target WordPress site (unauthenticated).
5. Extract sensitive data: Review the server's response for included file contents — database credentials from wp-config.php can enable full database takeover; other files may reveal further attack vectors (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting theme-related PHP files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files that should not be web-accessible.
• Application: WordPress error logs showing PHP include/require failures for unusual file paths, or successful inclusion of non-theme files.

No official patch from ThemeREX is available for Kayon theme versions ≤ 1.3 as of the disclosure date. Site owners should immediately remove or disable the Kayon theme if a patched version is not available. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. Additionally, deploying a Web Application Firewall (WAF) with rules targeting LFI patterns, restricting PHP file inclusion at the server level (e.g., open_basedir restrictions), and monitoring server logs for path traversal attempts are recommended interim measures (Patchstack).

Wordfence included CVE-2026-28027 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it among notable disclosures for that week. Patchstack, which discovered and disclosed the vulnerability, has flagged it as high priority and noted that LFI vulnerabilities of this class are commonly leveraged in mass-exploit campaigns against WordPress sites.