CVE-2026-28081: 
WordPress vulnerability analysis and mitigation

CVE-2026-28081 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Windsor WordPress theme that allows unauthenticated remote attackers to include and execute arbitrary local PHP files on the server. It affects Windsor versions up to and including 2.5.0, with no official patch currently available. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 8, 2025, and publicly disclosed on February 27, 2026, via Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized to a PHP include or require statement within the Windsor theme. An unauthenticated attacker can manipulate file path parameters in HTTP requests to force the server to include arbitrary local files, potentially exposing sensitive content or executing PHP code already present on the server. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition (such as specific server configuration or knowledge of file paths) must be met (Patchstack, NVD).

Successful exploitation can allow an attacker to read sensitive files on the server — including configuration files containing database credentials — potentially leading to full database compromise. If the attacker can control file content (e.g., via log poisoning or uploaded files), LFI can escalate to remote code execution. The vulnerability impacts confidentiality, integrity, and availability, all rated High, and could facilitate lateral movement within a hosting environment (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Windsor theme version ≤ 2.5.0 via web crawlers, Shodan, or WPScan fingerprinting.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion endpoint — a parameter passed to a PHP include or require call without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated file path parameter (e.g., ?file=../../../../etc/passwd or a path to a known writable file containing PHP code) to the vulnerable theme endpoint.
4. Read sensitive files: If the server returns the contents of the targeted file (e.g., /etc/passwd, wp-config.php), extract credentials or configuration data.
5. Escalate to code execution (optional): If a writable file containing attacker-controlled PHP code exists on the server (e.g., via log poisoning or a previously uploaded file), include it through the LFI vector to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET/POST requests to Windsor theme PHP files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting sensitive file paths such as wp-config.php or /etc/passwd.
• Logs: WordPress or web server access logs showing repeated requests with file path manipulation patterns to theme-related endpoints; HTTP 200 responses to requests containing traversal sequences.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme folder; modified theme files containing injected PHP code.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following suspicious theme file requests.

No official patch from ThemeREX is currently available for Windsor versions ≤ 2.5.0. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended interim mitigations include: deploying a Web Application Firewall (WAF) with rules to detect and block LFI patterns; validating and sanitizing all user-supplied file path inputs; disabling PHP remote file inclusion (allow_url_include = Off in php.ini); applying least-privilege permissions to the web server process; and monitoring access logs for path traversal patterns. Site owners should monitor ThemeREX and Patchstack for an official patched release and apply it immediately upon availability (Patchstack).

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, with Patchstack coordinating the disclosure and issuing a virtual mitigation rule in the absence of an official vendor patch. Patchstack classified it as high priority, warning that LFI vulnerabilities of this severity are commonly leveraged in mass WordPress exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).