CVE-2026-28086: 
WordPress vulnerability analysis and mitigation

CVE-2026-28086 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Run Gran WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Run Gran theme up to and including version 2.0, and was reported by security researcher Bonds on August 31, 2025, with public disclosure on March 5, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by CISA-ADP (Patchstack, NVD).

The vulnerability stems from improper validation and sanitization of user-supplied input used in PHP file inclusion statements (include/require) within the Run Gran theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (AC:H), meaning specific conditions or knowledge of the target environment may be necessary, but no authentication or user interaction is needed (Patchstack, NVD). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, private keys, and application source code. Depending on server configuration, attackers may escalate to remote code execution by including files containing attacker-controlled PHP content (e.g., uploaded files), leading to full system compromise with high confidentiality, integrity, and availability impacts. This could further enable database takeover, lateral movement within the hosting environment, or persistent backdoor installation (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently leveraged in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity.

1. Reconnaissance: Identify WordPress sites using the Run Gran theme (version ≤ 2.0) via web crawlers, Wappalyzer, or by inspecting page source for theme references (e.g., /wp-content/themes/run-gran/).
2. Identify vulnerable parameter: Analyze the theme's PHP code or HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft LFI payload: Construct an HTTP request with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) targeting the vulnerable endpoint.
4. Extract sensitive files: Send the crafted request to the target server and retrieve the contents of sensitive files such as wp-config.php (database credentials), /etc/passwd, or SSL private keys.
5. Escalate to RCE (if conditions allow): If the server permits inclusion of attacker-controlled content (e.g., via a previously uploaded file or PHP session file), include a PHP web shell to achieve remote code execution (Patchstack).

• Network: HTTP GET/POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters; unusual outbound connections from the web server process.
• Logs: Web server access logs showing requests with encoded traversal patterns (e.g., %2e%2e%2f) targeting Run Gran theme files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Presence of unexpected PHP files (web shells) in the WordPress uploads directory (/wp-content/uploads/); modification timestamps on wp-config.php or other core files inconsistent with normal operations.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget) indicating potential code execution following LFI exploitation.

As of the disclosure date, no official patch from ThemeREX is available for the Run Gran theme (Patchstack). Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended interim mitigations include: (1) replacing or disabling the Run Gran theme if possible; (2) disabling allow_url_include and allow_url_fopen in php.ini; (3) applying strict web server file permission controls (principle of least privilege); and (4) deploying a Web Application Firewall (WAF) with LFI detection rules to block path traversal attempts.

Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of February 23 – March 1, 2026, highlighting it as part of broader WordPress theme security coverage (Wordfence). Patchstack, which discovered and disclosed the vulnerability, classified it as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites (Patchstack). No significant broader media coverage or notable researcher commentary beyond these sources has been identified.