CVE-2026-28035: 
WordPress vulnerability analysis and mitigation

CVE-2026-28035 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Printy WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Printy theme through version 1.8 and was disclosed on March 2, 2026, by researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, with the CVE published on March 5, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by CISA-ADP (Patchstack, Wordfence).

The root cause is improper sanitization and validation of filename parameters passed to PHP include or require statements within the Printy theme (CWE-98). An unauthenticated remote attacker can manipulate these parameters to include arbitrary local files from the server's filesystem, potentially exposing sensitive content such as configuration files or credentials. The attack vector is network-based with high attack complexity and requires no privileges or user interaction. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including files containing database credentials (e.g., wp-config.php), which could lead to complete database compromise. The vulnerability carries high confidentiality, integrity, and availability impacts — an attacker could leverage exposed credentials for lateral movement, data exfiltration, or further system compromise. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Printy theme version 1.8 or earlier using tools like WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Analyze the theme's PHP code or HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send a crafted HTTP request (e.g., GET or POST) to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file, such as ../../../../wp-config.php or /etc/passwd.
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, which may contain database credentials, API keys, or other sensitive configuration data.
5. Escalate access: Use extracted credentials (e.g., WordPress database credentials from wp-config.php) to gain administrative access to the database or WordPress admin panel for further compromise (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting the Printy theme endpoints.
• Logs: Web server access logs showing requests with encoded or plaintext directory traversal patterns to theme-related PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other configuration files by the web server process.
• Process: PHP process reading files outside the expected web root directory, observable via file access monitoring tools (e.g., auditd on Linux).

As of the disclosure date, no official patch from ThemeREX is available for the Printy theme. Site owners should consider replacing or deactivating the theme until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additional mitigations include: setting allow_url_include = Off in php.ini, implementing a Web Application Firewall (WAF) with rules to detect path traversal patterns, and enforcing strict input validation on all filename parameters. Regularly auditing file inclusion patterns and monitoring web server logs for traversal attempts is also recommended (Patchstack).

Wordfence included CVE-2026-28035 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as a notable theme-level LFI issue (Wordfence). Patchstack, which discovered and disclosed the vulnerability, emphasized the high-risk nature of LFI vulnerabilities in WordPress themes and their potential for mass exploitation campaigns (Patchstack). No significant broader media coverage or notable social media discussion has been identified beyond these security community reports.