CVE-2026-28068: 
WordPress vulnerability analysis and mitigation

CVE-2026-28068 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Rhythmo WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Rhythmo theme up to and including version 1.3.4, with no official patch currently available. The vulnerability was reported on September 14, 2025, and publicly disclosed on February 27, 2026, by Patchstack researcher "Bonds." It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Rhythmo theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal constraints). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the web server's filesystem, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), /etc/passwd, or other files accessible to the web server process. This can lead to full database compromise, credential theft, and potentially remote code execution if the attacker can include a file containing PHP code (e.g., a previously uploaded file or a log file with injected content). The vulnerability carries high confidentiality, integrity, and availability impact ratings (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053% (0.000530), indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Rhythmo theme (version ≤ 1.3.4) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft LFI payload: Construct an HTTP request with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) targeting the vulnerable endpoint.
4. Extract sensitive data: Submit the crafted request and review the server response for included file contents, such as WordPress database credentials from wp-config.php or system files like /etc/passwd.
5. Escalate if possible: If the server allows inclusion of attacker-controlled content (e.g., uploaded files or log poisoning), attempt to achieve remote code execution by including a file containing PHP code.

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or form fields; requests returning unexpected file content (e.g., PHP configuration data).
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme-related PHP files; repeated 200 OK responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process; newly created or modified files in the theme directory.
• Process: Web server processes (e.g., Apache, Nginx, PHP-FPM) spawning unexpected child processes or making outbound network connections following suspicious file inclusion requests.

No official patch from ThemeREX is currently available for the Rhythmo theme. Site administrators are advised to deactivate and remove the Rhythmo theme until a patched version (above 1.3.4) is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additional mitigations include deploying a Web Application Firewall (WAF) configured to detect and block path traversal and LFI patterns, restricting PHP file inclusion via open_basedir settings, and applying the principle of least privilege to web server processes (Patchstack).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability intelligence report covering the period of February 23 – March 1, 2026, indicating it received attention within the WordPress security community. Patchstack, the assigning CNA, classified it as high priority and noted the class of vulnerability is commonly leveraged in mass-exploit campaigns against WordPress sites. No significant vendor statements from ThemeREX or broader media coverage have been identified at this time.