CVE-2026-28036: 
WordPress vulnerability analysis and mitigation

CVE-2026-28036 is a Server-Side Request Forgery (SSRF) vulnerability in the SkatDesign Ratatouille WordPress theme. It affects all versions of the Ratatouille theme up to and including version 1.2.6, with no official patch currently available. The vulnerability was reported on September 29, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and publicly disclosed on March 2–5, 2026. It carries a CVSS v3.1 base score of 6.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and allows an authenticated attacker with at least Subscriber-level privileges to cause the WordPress server to issue HTTP requests to arbitrary external or internal domains of the attacker's choosing. The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope, meaning the impact extends beyond the vulnerable component itself. No detailed technical write-up or public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to force the vulnerable WordPress server to make requests to arbitrary internal or external URLs, potentially exposing sensitive information from internal services (e.g., cloud metadata endpoints, internal APIs) that are not directly accessible from the internet. The confidentiality and integrity impacts are both rated Low, with no direct availability impact; however, the changed scope indicates that systems beyond the WordPress installation itself may be affected. This type of vulnerability is commonly leveraged in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

The vulnerability requires a low level of privilege (Subscriber role or higher) and no user interaction, making it relatively accessible to attackers who can register or obtain a low-privilege account on a target WordPress site. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the wild. No evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog has been identified. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns against WordPress sites (Patchstack).

As of the disclosure date, no official patch from SkatDesign is available for the Ratatouille theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators are advised to remove or deactivate the Ratatouille theme if possible, restrict user registration to prevent low-privilege account creation, and consider deploying a web application firewall (WAF) with SSRF-specific rules. Monitoring outbound HTTP requests from the WordPress server for anomalous destinations is also recommended (Patchstack).