CVE-2026-28051: 
WordPress vulnerability analysis and mitigation

CVE-2026-28051 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Yacht Rental WordPress theme, caused by improper control of filenames used in PHP include/require statements (CWE-98). It affects all versions of the Yacht Rental theme up to and including version 2.6. The vulnerability was published on March 5, 2026, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction, though with high attack complexity (Feedly, Patchstack).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is insufficiently validated before being passed to PHP's include or require statements within the Yacht Rental theme. An unauthenticated remote attacker can craft a network request that manipulates the filename parameter to include arbitrary local files from the server's filesystem. The high attack complexity rating suggests that exploitation may require specific conditions or bypasses to be met, such as particular server configurations or path traversal techniques (Feedly).

Successful exploitation allows an attacker to read arbitrary files from the server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php containing database credentials), system files, or other confidential information. Beyond confidentiality, the vulnerability also carries high integrity and availability impact ratings, meaning that under certain conditions — such as chaining with file upload vulnerabilities — an attacker could achieve code execution, modify system files, or disrupt service availability. The attack requires no authentication or user interaction, making it accessible to any network-reachable attacker (Feedly).

As of the time of reporting, there is no public proof-of-concept (PoC) exploit available, and no evidence of active in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Yacht Rental theme version ≤ 2.6 via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible WordPress installations.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) targeting the vulnerable endpoint, injecting a path traversal payload (e.g., ../../../../wp-config.php) into the filename parameter.
4. Retrieve sensitive files: Submit the crafted request to the target server; if successful, the server will include and return the contents of the targeted local file (e.g., WordPress database credentials from wp-config.php).
5. Escalate access: Use retrieved credentials or other sensitive data to pivot further — for example, accessing the WordPress admin panel, the database, or other server resources (Feedly).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields targeting the Yacht Rental theme endpoints.
• Logs: WordPress or web server access logs showing repeated requests with encoded path traversal strings to theme-related PHP files; HTTP 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files reflected in PHP error logs or access logs.
• Process: PHP error log entries indicating failed or successful file inclusion of unexpected paths, particularly outside the WordPress web root.

No official patch has been confirmed as available at the time of reporting; users should check the WordPress plugin/theme repository or the ThemeREX vendor site for updates beyond version 2.6. As an immediate workaround, administrators should implement strict input validation and sanitization for all filename parameters used in PHP include/require statements. Additional mitigations include applying PHP's open_basedir restriction to limit file access scope, using the disable_functions directive to restrict dangerous PHP functions, enforcing the principle of least privilege on file permissions, and monitoring web server access logs for path traversal patterns (Feedly, Patchstack).

Coverage of CVE-2026-28051 has been limited, with early mentions appearing on managed WordPress security blogs and LinkedIn security community posts shortly after disclosure. The vulnerability was indexed by threat intelligence aggregators including VulDB and radar.offseq.com within days of publication. No significant vendor statements or notable researcher commentary beyond the Patchstack advisory have been identified (Feedly).