CVE-2026-28031: 
WordPress vulnerability analysis and mitigation

CVE-2026-28031 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Invetex WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Invetex theme up to and including version 2.18, and was published on March 2–5, 2026. The vulnerability was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and reported to Patchstack on September 30, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Invetex theme (CWE-98). An unauthenticated remote attacker can manipulate parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server. No authentication or user interaction is required, though the attack complexity is rated High, suggesting specific conditions or non-default configurations may need to be met. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and was assigned Patchstack ID PSID918311494994 (Patchstack).

Successful exploitation allows an attacker to include and execute arbitrary local files on the WordPress server, potentially exposing sensitive files such as configuration files containing database credentials, WordPress wp-config.php, or system files like /etc/passwd. This can lead to full database compromise, credential theft, unauthorized code execution, and complete takeover of the WordPress installation. The vulnerability has a HIGH impact on confidentiality, integrity, and availability (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low but non-negligible probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Invetex theme version 2.18 or earlier using tools like WPScan, Shodan, or by inspecting page source for theme indicators.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion logic — typically a parameter passed via GET or POST request that controls which file is included (e.g., a template, file, or page parameter).
3. Craft malicious request: Send an HTTP request with a manipulated parameter value pointing to a sensitive local file, such as ../../../../wp-config.php or /etc/passwd, using path traversal sequences.
4. Retrieve sensitive data: If successful, the server's response will contain the contents of the included file, potentially exposing database credentials, secret keys, or other sensitive configuration data.
5. Escalate access: Use extracted credentials (e.g., database username/password from wp-config.php) to access the WordPress database directly, create admin accounts, or pivot to further compromise the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; requests targeting sensitive file paths such as wp-config.php or /etc/passwd.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded or decoded path traversal patterns in query strings; PHP error logs indicating failed file inclusion attempts or unexpected file reads.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files that should not be accessed via web requests.
• Process: Unusual PHP process activity reading files outside the WordPress web root; unexpected outbound connections from the web server process following a successful inclusion.

No official patch from ThemeREX is currently available for the Invetex theme. As an immediate measure, site owners should consider disabling or replacing the vulnerable theme until a patch is released. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts automatically. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal and local file inclusion patterns is recommended. Site owners should also monitor web server logs for suspicious file inclusion attempts and contact ThemeREX directly for patch availability (Patchstack).

Wordfence included CVE-2026-28031 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of theme vulnerabilities. Patchstack, which coordinated the disclosure, has issued a mitigation rule and classifies the vulnerability as high priority, warning that LFI vulnerabilities of this severity are commonly leveraged in mass-exploit campaigns against WordPress sites (Wordfence, Patchstack).