CVE-2026-28034: 
WordPress vulnerability analysis and mitigation

CVE-2026-28034 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Progress WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Progress theme through and including version 1.2, and was reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity on September 30, 2025, with public disclosure on March 2–5, 2026. The vulnerability was assigned a CVSS v3.1 base score of 8.1 (High) by CISA-ADP (Patchstack, NVD).

The root cause is improper validation and sanitization of filenames passed to PHP include or require statements within the ThemeREX Progress theme (CWE-98). An unauthenticated remote attacker can manipulate user-controlled input to influence the file path used in a PHP include/require call, causing the server to include and execute arbitrary local files. Exploitation requires high attack complexity (e.g., specific preconditions such as knowledge of file paths or race conditions), but no authentication or user interaction is needed. No public proof-of-concept exploit code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive files such as WordPress configuration files (e.g., wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability carries high impact across confidentiality, integrity, and availability — an attacker could read sensitive data, modify application behavior, or disrupt service. Depending on server configuration, LFI may also be chained with other techniques (e.g., log poisoning) to achieve remote code execution (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic size (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Progress theme version ≤ 1.2 via tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send a crafted HTTP request (unauthenticated) to the vulnerable endpoint, supplying a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, potentially exposing database credentials, API keys, or other configuration secrets.
5. Escalate (optional): Chain the LFI with log poisoning or other techniques to inject PHP code into a server-accessible log file, then include it via the LFI to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: WordPress or web server access logs showing requests with encoded traversal patterns targeting theme-related PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process; new or modified files in the theme directory.
• Process: Web server processes (e.g., Apache, Nginx, PHP-FPM) spawning unexpected child processes, which may indicate successful escalation from LFI to RCE via log poisoning or similar techniques.

As of the disclosure date, no official patch from ThemeREX is available for the Progress theme. Organizations should immediately consider deactivating or replacing the theme if a patched version is not yet released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is available. Additional mitigations include deploying a Web Application Firewall (WAF) configured to detect and block path traversal and file inclusion patterns, restricting PHP's allow_url_include and open_basedir settings in php.ini, and applying the principle of least privilege to web server file system access (Patchstack).

Wordfence included CVE-2026-28034 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of theme and plugin vulnerabilities disclosed that week. Patchstack, the discovering and reporting organization, classified it as high priority and noted the potential for mass-exploit campaigns targeting WordPress sites using this class of vulnerability (Wordfence Weekly Report, Patchstack).