CVE-2026-28066: 
WordPress vulnerability analysis and mitigation

CVE-2026-28066 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Legrand WordPress theme, affecting all versions up to and including 2.17. The flaw stems from improper control of filenames in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. It was reported by security researcher "Bonds" on September 14, 2025, and publicly disclosed on February 27, 2026, with the CVE record published on March 5, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is passed unsanitized to PHP include() or require() statements within the Legrand theme. This allows an unauthenticated attacker to manipulate the filename parameter to traverse the server's file system and include arbitrary local files. Exploitation requires no authentication and no user interaction, though the high attack complexity rating suggests some precondition or bypass may be involved (e.g., specific server configuration or path traversal constraints). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary files from the web server that the PHP process has permission to access, including sensitive configuration files such as wp-config.php (containing database credentials), private keys, and other application secrets. Exposure of database credentials could lead to complete database takeover, and access to authentication keys could enable full WordPress site compromise. The vulnerability affects confidentiality, integrity, and availability at a high level, potentially enabling lateral movement or further system compromise if sensitive credentials are harvested (Patchstack).

As of the time of disclosure, no public proof-of-concept exploit exists and no active in-the-wild exploitation has been observed. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with high CVSS scores) are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Legrand theme version ≤ 2.17 via tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP include/require functionality that accepts user-controlled input for file paths — typically exposed through a theme template or AJAX handler.
3. Craft LFI payload: Construct an HTTP request with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) targeting the vulnerable include statement.
4. Send malicious request: Submit the crafted request to the target WordPress site without authentication, triggering the vulnerable PHP include/require statement.
5. Retrieve sensitive files: Observe the server response for the contents of the included file (e.g., wp-config.php exposing database credentials, DB_NAME, DB_USER, DB_PASSWORD) and use extracted credentials for further compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies; repeated requests from a single IP to theme-related PHP files.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting theme files; PHP error logs indicating failed file inclusion attempts or unexpected file paths being accessed.
• File System: No direct file system artifacts expected for read-only LFI, but monitor for unexpected file reads of sensitive files like wp-config.php, /etc/passwd, or SSL private keys by the web server process.
• Process: Unusual PHP process activity reading files outside the WordPress web root; web application firewall (WAF) alerts triggered by LFI pattern signatures.

No official patch from ThemeREX is currently available for the Legrand theme. Users should upgrade to a version newer than 2.17 as soon as a patched release is published. In the interim, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts. Additional workarounds include deploying a Web Application Firewall (WAF) with LFI detection rules, restricting file system permissions to limit what the web server process can read, and considering disabling or replacing the vulnerable theme until a fix is available (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," classified it as high priority and noted that LFI vulnerabilities of this severity are commonly leveraged in mass WordPress exploitation campaigns. Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of February 23 – March 1, 2026, indicating broader community awareness within the WordPress security ecosystem (Patchstack).