CVE-2026-28030: 
WordPress vulnerability analysis and mitigation

CVE-2026-28030 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Bonbon WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Bonbon theme up to and including version 1.6, and was published on March 2–5, 2026, with discovery credited to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity (reported September 30, 2025). The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction (Patchstack, Feedly).

The root cause is improper validation and sanitization of filename parameters passed to PHP include/require statements within the Bonbon theme (CWE-98). An unauthenticated remote attacker can manipulate these parameters to force the server to include arbitrary local files, potentially exposing their contents. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition (such as specific server configuration or parameter guessability) must be met. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability poses high risks to confidentiality, integrity, and availability, and could serve as a stepping stone for further system compromise or lateral movement within the hosting environment (Patchstack).

As of the time of reporting, no public proof-of-concept exploit exists and no active in-the-wild exploitation has been observed. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Bonbon theme version 1.6 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/bonbon).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send an HTTP request (GET or POST) to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, which may contain database credentials, API keys, or other sensitive configuration data.
5. Escalate access: Use extracted credentials (e.g., database username/password from wp-config.php) to access the WordPress database directly or escalate privileges on the server (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; repeated requests to theme PHP files from a single IP.
• Logs: Web server access logs showing requests with encoded or raw directory traversal strings targeting Bonbon theme files; HTTP 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process.
• Process: PHP process reading files outside the WordPress web root, particularly system configuration files or credential stores.

No official patch from ThemeREX is available as of the disclosure date; the vulnerable version remains 1.6 and below with no patched version published. Site owners should immediately consider deactivating or replacing the Bonbon theme until a fix is released. Patchstack has issued a virtual patch (mitigation rule) for its subscribers to block exploitation attempts in the interim. Additional mitigations include deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns, enforcing strict file permission policies on the web server, and monitoring server logs for suspicious file access patterns (Patchstack).

Wordfence included CVE-2026-28030 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, the assigning CNA, rated it high priority and noted the class of vulnerability is commonly leveraged in mass-exploit campaigns against WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond these security vendor reports (Wordfence, Patchstack).