CVE-2026-28064: 
WordPress vulnerability analysis and mitigation

CVE-2026-28064 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Edge Decor WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects Edge Decor versions up to and including 2.2, allowing unauthenticated network attackers to include arbitrary local files. The vulnerability was published on March 5, 2026, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Edge Decor theme (CWE-98). An attacker can manipulate a filename parameter passed to a PHP file inclusion function, causing the server to include arbitrary local files from the filesystem. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal constraints). No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation could allow an unauthenticated remote attacker to read sensitive files from the server, including WordPress configuration files (wp-config.php), database credentials, and other confidential data. In scenarios where file upload functionality is available, LFI can be chained to achieve remote code execution, potentially leading to full system compromise. The integrity and availability of the affected WordPress installation and underlying infrastructure are also at risk (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest available data.

No official patch has been confirmed in the available vulnerability data for Edge Decor versions through 2.2. As an immediate workaround, administrators should disable or deactivate the Edge Decor theme until a patched version is released. Deploying Web Application Firewall (WAF) rules to detect and block path traversal and file inclusion patterns (e.g., ../, %2e%2e, php://) is recommended. Reviewing web server access logs for unusual file inclusion request patterns can help identify potential exploitation attempts (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering the period of February 23 to March 1, 2026, indicating it received standard industry tracking attention (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond routine vulnerability database entries.