CVE-2026-28077: 
WordPress vulnerability analysis and mitigation

CVE-2026-28077 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Vapester WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Vapester theme up to and including 1.1.10, and was reported by researcher Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 10, 2025, with public disclosure on February 27, 2026. The CVE was formally published on March 5, 2026, by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper validation and sanitization of user-supplied input used in PHP include/require statements within the Vapester theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting specific conditions or non-default configurations must be met. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability has high impact on confidentiality, integrity, and availability of the affected system. In scenarios where file upload functionality is present, LFI can be chained to achieve remote code execution (Patchstack).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the latest available data. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Vapester theme version 1.1.10 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/vapester).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, which may contain database credentials, API keys, or other sensitive configuration data.
5. Escalate (optional): If a writable upload directory exists and a malicious file has been uploaded, chain the LFI to include the uploaded file and achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to Vapester theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or form fields.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting theme files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files as reflected in server access logs.
• Process: PHP error logs showing include()/require() failures for unusual file paths, which may indicate failed exploitation attempts.

No official patch from ThemeREX was available as of the latest data; users should monitor the theme's update channel and apply any released patch immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts. Site owners unable to patch should consider disabling or removing the Vapester theme, restricting access to the WordPress installation via IP allowlisting, and deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns (Patchstack).