CVE-2026-28053: 
WordPress vulnerability analysis and mitigation

CVE-2026-28053 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Miller WordPress theme (slug: christine-miller). It stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files on the server. All versions up to and including 1.3.3 are affected. The vulnerability was published on March 5, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability arises because the ThemeREX Miller theme passes user-controlled input directly — or with insufficient sanitization — into PHP include() or require() statements, enabling an attacker to manipulate the filename parameter to reference arbitrary files on the local filesystem. The attack vector is network-based, requires no authentication or user interaction, but is rated High complexity, suggesting some precondition (e.g., a specific request structure or parameter) must be met. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation could allow an attacker to read sensitive local files such as WordPress configuration files (wp-config.php), exposing database credentials and secret keys. Beyond information disclosure, if an attacker can control file content (e.g., via log poisoning or uploaded files), LFI can escalate to remote code execution, fully compromising the server's confidentiality, integrity, and availability. The CVSS assessment rates all three impact dimensions as High (Feedly).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The High attack complexity rating further reduces the immediate exploitation risk.

No official patch has been confirmed as available for the ThemeREX Miller theme beyond version 1.3.3. Site administrators should check for an updated theme version from ThemeREX and apply it immediately if available. As interim mitigations: implement strict input validation and sanitization for all filename parameters; configure PHP settings (e.g., open_basedir) to restrict file access; deploy Web Application Firewall (WAF) rules to detect and block LFI patterns in requests; and monitor web server and PHP error logs for suspicious file inclusion attempts. If no patch is available, consider deactivating the theme until a fix is released (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering the period of February 23 – March 1, 2026, indicating routine tracking by the WordPress security community (Wordfence). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings.