CVE-2026-28067: 
WordPress vulnerability analysis and mitigation

CVE-2026-28067 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Bassein WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Bassein theme up to and including version 1.0.15. The vulnerability was reported by security researcher "Bonds" on September 14, 2025, and publicly disclosed by Patchstack on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Bassein theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters passed to these PHP file inclusion functions to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (e.g., specific conditions or path manipulation), but no privileges or user interaction are needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the web server, such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability carries high confidentiality, integrity, and availability impacts — attackers may expose credentials, alter application behavior by including malicious PHP files already present on the server, or disrupt site operations. The scope is limited to the affected WordPress installation, but credential exposure could enable lateral movement to backend databases or other services (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has issued a virtual patch (WAF mitigation rule) to block exploitation attempts until an official patch is available (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Bassein theme version 1.0.15 or earlier using tools like WPScan, Shodan, or by inspecting page source for theme indicators.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion point — a parameter or request value that is passed unsanitized to a PHP include() or require() function.
3. Craft malicious request: Send a crafted HTTP request (GET or POST) to the vulnerable WordPress endpoint, manipulating the filename parameter to reference a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Retrieve file contents: If the server processes the inclusion, the contents of the targeted local file are returned in the HTTP response, exposing credentials or other sensitive data.
5. Escalate access: Use exposed database credentials from wp-config.php to access the WordPress database directly, enabling account takeover, data exfiltration, or further compromise (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded or plaintext directory traversal patterns targeting theme PHP files; HTTP 200 responses to requests containing file path strings like wp-config, passwd, or shadow.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files not normally accessed by the web process.
• Process: PHP error logs showing file inclusion warnings or failures referencing unexpected file paths outside the theme directory.

As of the disclosure date, no official patch from ThemeREX is available for the Bassein theme. Site owners should monitor the WordPress theme repository or ThemeREX's official channels for an updated version and apply it immediately when released. In the interim, Patchstack users benefit from an automatically applied virtual patch (WAF rule) blocking exploitation attempts. Additional mitigations include: deploying a web application firewall (WAF) with rules to detect path traversal and LFI patterns; disabling allow_url_include in php.ini; restricting file system permissions so the web server process cannot read sensitive files outside the web root; and considering temporarily deactivating the theme if exposure risk is unacceptable (Patchstack).

Wordfence included CVE-2026-28067 in its weekly WordPress vulnerability report covering February 23 – March 1, 2026, highlighting it as part of broader WordPress ecosystem security monitoring. Patchstack, the discovering and reporting organization, issued a mitigation rule and published the advisory, noting the vulnerability's high CVSS score and potential for mass-exploit campaigns targeting WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond these standard vulnerability reporting channels.