CVE-2026-28084: 
WordPress vulnerability analysis and mitigation

CVE-2026-28084 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Bazinga WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Bazinga theme through and including version 1.1.9, with no official patch currently available. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and publicly disclosed by Patchstack on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, Feedly).

The root cause is improper sanitization and validation of user-supplied input used in PHP include or require statements within the Bazinga theme (CWE-98). An unauthenticated remote attacker can manipulate a filename parameter passed to these PHP constructs to include arbitrary local files from the server's filesystem. The attack vector is network-based, requires no privileges or user interaction, but has high attack complexity, suggesting some precondition such as specific server configuration or knowledge of file paths may be required. No public proof-of-concept exploit code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), /etc/passwd, or other files accessible to the web server process. This can lead to full database compromise, credential theft, and — if combined with a file upload vulnerability or writable directory — remote code execution and complete server takeover. The confidentiality, integrity, and availability impacts are all rated High (Patchstack, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Bazinga theme (version ≤ 1.1.9) via passive scanning tools (e.g., WPScan, Shodan, or BuiltWith) by detecting theme-specific assets or metadata in page source.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the endpoint or parameter that is passed unsanitized to a PHP include or require statement.
3. Craft malicious request: Construct an HTTP request (GET or POST) that supplies a manipulated filename value (e.g., ../../../../wp-config.php or /etc/passwd) to the vulnerable parameter.
4. Retrieve sensitive file contents: Submit the crafted request to the target site; if successful, the server will include and output the contents of the targeted local file, exposing credentials or other sensitive data.
5. Escalate if possible: Use exposed database credentials or other secrets to pivot to database access, administrative login, or further exploitation of the server (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields targeting WordPress theme endpoints; unexpected outbound connections from the web server process.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded or plaintext directory traversal patterns to theme-related PHP endpoints; PHP error logs referencing unexpected file inclusion paths or failed to open stream errors for sensitive system files.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files; presence of web shells in writable directories if exploitation was chained with a file upload.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation (Patchstack).

No official patch from ThemeREX is currently available for the Bazinga theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) upgrading the Bazinga theme to a version greater than 1.1.9 if/when released; (2) deploying a Web Application Firewall (WAF) with rules to detect and block path traversal and LFI patterns; (3) implementing strict input validation and allowlisting for any user-supplied parameters used in PHP include/require statements; and (4) restricting web server file system permissions to limit access to sensitive files (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability intelligence report covering the period of February 23 – March 1, 2026, highlighting it as a notable theme-level LFI issue. Patchstack, the assigning CNA, flagged it as high priority and noted that LFI vulnerabilities of this CVSS score class are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable researcher commentary beyond these standard security intelligence channels has been identified (Wordfence, Patchstack).