CVE-2026-28062: 
WordPress vulnerability analysis and mitigation

CVE-2026-28062 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Happy Baby WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects Happy Baby theme versions up to and including 1.2.12, allowing unauthenticated remote attackers to include arbitrary files on the server. The vulnerability was published on March 5, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of user-supplied filenames used in PHP include/require statements (CWE-98), which enables both Local File Inclusion (LFI) and potentially Remote File Inclusion (RFI) attacks. An unauthenticated attacker can craft a network request that manipulates a filename parameter accepted by the theme, causing the PHP interpreter to include arbitrary files from the server's filesystem. Exploitation requires no privileges and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal technique). No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation can result in high confidentiality, integrity, and availability impacts. An attacker could read sensitive server files such as WordPress configuration files (wp-config.php) containing database credentials, inject malicious content, or — depending on server configuration and available writable files — achieve remote code execution. This could facilitate full site compromise, credential theft, and potential lateral movement within the hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation reported. The vulnerability has an EPSS score of approximately 0.053% (0.000530), indicating a low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Happy Baby theme version ≤ 1.2.12 via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the endpoint and parameter that accepts a user-controlled filename for inclusion (e.g., a file, template, or page parameter in a theme function).
3. Craft LFI payload: Construct a malicious HTTP request targeting the vulnerable parameter with a path traversal sequence to reference sensitive files, e.g., ?file=../../../../wp-config.php or ?file=../../../../etc/passwd.
4. Extract sensitive data: Submit the crafted request and parse the server response for included file contents, such as database credentials from wp-config.php.
5. Escalate if possible: If the server has allow_url_include enabled or writable directories with attacker-controlled content (e.g., uploaded files), attempt to include a PHP web shell to achieve remote code execution (Feedly).

• Network: Unusual HTTP GET/POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in filename-related parameters; requests referencing sensitive paths like wp-config.php or /etc/passwd.
• Logs: WordPress or web server access logs showing repeated requests to theme PHP files with suspicious query parameters containing directory traversal patterns; HTTP 200 responses to requests that include sensitive file paths.
• File System: Unexpected PHP web shells or newly created files in the WordPress uploads directory or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual PHP child processes spawned by the web server (e.g., curl, wget, bash) that may indicate successful code execution following LFI exploitation (Feedly).

The primary remediation is to upgrade the ThemeREX Happy Baby theme to a version newer than 1.2.12; however, no specific patched version has been confirmed in available data. As interim mitigations: disable PHP's allow_url_include directive in php.ini to prevent remote file inclusion; implement strict server-side input validation on any user-controlled filename parameters; deploy Web Application Firewall (WAF) rules to detect and block LFI/RFI patterns; and restrict file system permissions to limit the files accessible via PHP inclusion. Monitor application logs for path traversal attempts (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering the period of February 23 – March 1, 2026, indicating it received standard coverage within the WordPress security community. No significant independent researcher commentary, vendor statements beyond the Patchstack advisory, or notable social media discussion has been identified (Wordfence).