CVE-2026-28061: 
WordPress vulnerability analysis and mitigation

CVE-2026-28061 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Tiger Claw WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects Tiger Claw versions up to and including 1.1.14, allowing unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability was published on March 5, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of filename parameters passed to PHP include or require statements within the Tiger Claw theme (CWE-98). An attacker can manipulate these filename parameters to point to arbitrary local files on the server, enabling local file inclusion without authentication. The attack vector is network-based with high attack complexity and requires no privileges or user interaction. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation could allow an unauthenticated attacker to read sensitive local files (e.g., configuration files containing database credentials), modify website content through arbitrary file inclusion, and potentially achieve remote code execution if writable files or upload directories can be leveraged. This could result in unauthorized disclosure of sensitive information, website defacement, or complete compromise of the affected web server. All three security pillars — confidentiality, integrity, and availability — are rated as high impact (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement (AC:H) somewhat limits opportunistic exploitation (Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Tiger Claw theme version 1.1.14 or earlier using tools like WPScan, Shodan, or manual inspection of theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed directly to include() or require() statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request targeting the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Extract sensitive data: Submit the crafted request and observe the server response for included file contents, potentially exposing database credentials, API keys, or other sensitive configuration data.
5. Escalate if possible: If the server has accessible uploaded files (e.g., images with embedded PHP code), attempt to include those files to achieve remote code execution and further compromise the host (Feedly).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting theme PHP files with unexpected filename parameters.
• Logs: Web server access logs showing requests with encoded path traversal patterns directed at Tiger Claw theme endpoints; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files from the web server process; newly created or modified PHP files in the uploads directory.
• Process: PHP processes reading files outside the expected WordPress directory structure; unusual database connection attempts following suspicious web requests.

The primary remediation is to update the ThemeREX Tiger Claw theme to a version newer than 1.1.14, which contains the patch for this vulnerability. As interim mitigations, administrators should set allow_url_include = Off in php.ini to prevent remote file inclusion, and restrict PHP's include_path to specific trusted directories. Implementing a Web Application Firewall (WAF) with rules to detect and block path traversal patterns, and applying input validation with a whitelist approach for allowed filenames, are also recommended. Server logs should be monitored for suspicious include/require patterns (Feedly, Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of February 23 to March 1, 2026, indicating routine tracking by the WordPress security community. No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond standard vulnerability database entries (Wordfence).