CVE-2026-28032: 
WordPress vulnerability analysis and mitigation

CVE-2026-28032 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Tuning WordPress theme, affecting all versions up to and including 1.3. The flaw stems from improper control of filename input in PHP include/require statements (CWE-98). It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 30, 2025, and publicly disclosed on March 2–5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The ThemeREX Tuning theme fails to properly sanitize or validate user-supplied input before passing it to PHP file inclusion functions (include/require), allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) (Patchstack).

Successful exploitation allows a remote, unauthenticated attacker to include and render arbitrary local files from the server's filesystem, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), /etc/passwd, or other credential stores. This can lead to full database compromise, information disclosure, and potentially remote code execution if the attacker can chain the LFI with a file upload or log poisoning technique. All three security pillars — confidentiality, integrity, and availability — are rated High impact (Patchstack).

As of the disclosure date, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Tuning theme (version ≤ 1.3) via passive scanning tools (e.g., WPScan, Shodan) or by checking theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that accepts unsanitized user input.
3. Craft LFI payload: Construct an HTTP request targeting the vulnerable endpoint with a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) in the filename parameter.
4. Send the request: Submit the crafted request to the target WordPress site without authentication. If successful, the server will include and output the contents of the targeted local file.
5. Escalate: Use disclosed credentials (e.g., database credentials from wp-config.php) for further access, or chain with log poisoning or file upload techniques to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related PHP endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests with encoded traversal strings targeting theme files; HTTP 200 responses to requests with file path parameters pointing outside the web root.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files as reflected in server access logs.
• Process: PHP error logs showing file inclusion warnings or failures for paths outside the expected theme directory.

No official patch from ThemeREX is currently available for the Tuning theme. As immediate mitigations: disable or remove the ThemeREX Tuning theme if it is not actively required; implement a Web Application Firewall (WAF) rule to detect and block path traversal and LFI patterns in HTTP requests. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should also enforce strict file permissions and monitor server logs for anomalous file access patterns (Patchstack).

Patchstack, which coordinated the disclosure, has classified this as a high-priority vulnerability and issued a virtual mitigation rule for its users. The vulnerability was credited to researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who reported it through Patchstack's responsible disclosure process. No significant broader media coverage or notable social media commentary has been identified at this time (Patchstack).