CVE-2026-28079: 
WordPress vulnerability analysis and mitigation

CVE-2026-28079 is a PHP Local File Inclusion (LFI) vulnerability in the Conquerors WordPress theme developed by axiomthemes. It stems from improper control of filename parameters in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. All versions of the Conquerors theme up to and including 1.2.13 are affected. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 9, 2025, and published by Patchstack on February 27, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is passed unsanitized to PHP include() or require() statements within the Conquerors theme. An unauthenticated remote attacker can craft a malicious HTTP request that manipulates the filename parameter to point to sensitive local files on the server, causing the PHP interpreter to include and potentially expose their contents. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some conditions or constraints must be met for successful exploitation. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This can lead to complete database compromise, exposure of API keys and secrets, and potentially remote code execution if the attacker can include a file containing PHP code (e.g., via log poisoning or uploaded files). The vulnerability impacts confidentiality, integrity, and availability — all rated High — posing a significant risk to the entire WordPress installation and potentially the underlying server (Patchstack).

As of the time of publication, no public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies this as high priority, noting that vulnerabilities of this type are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Conquerors theme (version ≤ 1.2.13) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/conquerors/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or use fuzzing tools to locate the file inclusion parameter within the theme's template or shortcode handlers that passes user input to include() or require().
3. Craft malicious request: Construct an HTTP GET or POST request targeting the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Extract sensitive data: Submit the crafted request and observe the server response for included file contents, such as database credentials from wp-config.php or other configuration files.
5. Escalate if possible: If file upload functionality exists on the target, upload a PHP web shell, then use the LFI to include and execute it, achieving remote code execution (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body; repeated requests to theme PHP files from a single IP.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting Conquerors theme files; PHP error logs indicating failed file inclusion attempts referencing system paths.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory (/wp-content/uploads/) or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation.

As of the disclosure date, no official patch from the theme developer (axiomthemes) is available for the Conquerors theme. Site owners should consider deactivating and removing the Conquerors theme until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additional mitigations include deploying a Web Application Firewall (WAF) to filter path traversal patterns, restricting PHP file system permissions, and ensuring allow_url_include is disabled in php.ini. Monitor the Patchstack advisory and the WordPress theme repository for an official security update (Patchstack).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of February 23 – March 1, 2026, indicating it received standard industry tracking attention. No notable individual researcher commentary or significant social media discussion has been identified beyond routine vulnerability database entries. The lack of an available patch has been flagged as a concern by Patchstack, which has proactively issued a mitigation rule for its users (Patchstack).