CVE-2026-28089: 
WordPress vulnerability analysis and mitigation

CVE-2026-28089 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Daiquiri WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Daiquiri theme through 1.2.4 and can be exploited remotely by unauthenticated attackers. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and published by Patchstack on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the ThemeREX Daiquiri theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), /etc/passwd, or other server-side files. This can lead to full database compromise, credential theft, and potentially remote code execution if the attacker can control file content (e.g., via log poisoning or uploaded files). The vulnerability affects confidentiality, integrity, and availability at a high level, and could serve as a foothold for complete server compromise (Patchstack).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority, noting that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Daiquiri theme version 1.2.4 or earlier using tools like WPScan, Shodan, or Google dorks targeting theme-specific assets.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion point where user-controlled input is passed to an include or require statement without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated filename parameter (e.g., path traversal sequences like ../../../../wp-config.php) targeting the vulnerable endpoint.
4. Extract sensitive data: The server includes and outputs the contents of the targeted local file, potentially exposing database credentials from wp-config.php or other sensitive server files.
5. Escalate access: Use extracted credentials or session tokens to gain administrative access to the WordPress dashboard or the underlying database, enabling further lateral movement or full server compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related PHP endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files like wp-config.php or /etc/passwd.
• Logs: WordPress or web server access logs showing repeated requests with encoded traversal patterns to theme template or include endpoints; HTTP 200 responses to requests containing file path parameters.
• File System: Unexpected new files (e.g., web shells) in the WordPress uploads directory or theme folder; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual PHP processes spawning child processes (e.g., bash, curl, wget) from the web server user account.

As of the disclosure date, no official patch from ThemeREX is available for the Daiquiri theme. Site owners should immediately consider replacing or deactivating the theme until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additional mitigations include implementing a Web Application Firewall (WAF) with rules to block path traversal and file inclusion patterns, restricting PHP's allow_url_include directive, and enforcing strict input validation on all user-supplied data. Server logs should be reviewed for any suspicious file inclusion attempts (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and issued a virtual mitigation rule for its users. The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of February 23 – March 1, 2026, indicating broader community awareness within the WordPress security ecosystem. No significant vendor statements from ThemeREX or notable independent researcher commentary have been identified beyond the initial Patchstack disclosure.