CVE-2026-28087: 
WordPress vulnerability analysis and mitigation

CVE-2026-28087 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Filmax WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Filmax theme up to and including version 1.1.11, and was published on March 5, 2026, with the vulnerability originally reported by researcher 'Bonds' on August 31, 2025. The CVE was assigned and disclosed by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper control of filenames used in PHP include/require statements within the ThemeREX Filmax WordPress theme (CWE-98). Insufficient sanitization of user-supplied input allows an unauthenticated attacker to manipulate file path parameters, causing the PHP interpreter to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (e.g., specific conditions or race conditions must be met), but no authentication or user interaction is necessary. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation of this LFI vulnerability could allow an unauthenticated attacker to read sensitive files on the web server, such as configuration files containing database credentials (e.g., wp-config.php), potentially leading to full database compromise. If combined with a file upload vulnerability or log poisoning technique, an attacker could escalate to remote code execution with web server privileges. The vulnerability poses high risks to confidentiality, integrity, and availability of the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

As of the disclosure date, no official patch from ThemeREX has been released for the Filmax theme. Users should check with ThemeREX for updates beyond version 1.1.11 and apply any available patch immediately. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is available. As interim workarounds: disable the Filmax theme if not essential, implement strict input validation on file path parameters, disable PHP's allow_url_include and allow_url_fopen directives in php.ini, and deploy Web Application Firewall (WAF) rules to detect and block LFI patterns in HTTP requests (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, highlighting it as part of broader WordPress ecosystem security coverage. No significant vendor statements from ThemeREX or notable researcher commentary beyond the Patchstack disclosure have been identified.