CVE-2026-28090: 
WordPress vulnerability analysis and mitigation

CVE-2026-28090 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Gamezone WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Gamezone theme up to and including 1.1.11, and was reported by security researcher "Bonds" on August 31, 2025, with public disclosure on February 27, 2026 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The root cause is improper sanitization and validation of filename parameters passed to PHP include or require statements within the Gamezone theme (CWE-98). An unauthenticated remote attacker can manipulate these filename parameters over the network to force the PHP interpreter to include arbitrary local files from the server's filesystem. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability also carries High integrity and availability impact ratings, meaning attackers may be able to manipulate application behavior or cause service disruption depending on server configuration. In a worst-case scenario, if combined with a file upload vulnerability or other weaknesses, LFI can escalate to remote code execution (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Gamezone theme version 1.1.11 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/gamezone).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the endpoint and parameter that passes a filename to a PHP include or require statement without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Extract sensitive data: If successful, the server returns the contents of the included file (e.g., wp-config.php), exposing database credentials, authentication keys, and other configuration secrets.
5. Escalate access: Use extracted database credentials to access the WordPress database directly, potentially enabling full site takeover, admin account creation, or further lateral movement (Patchstack).

• Network: Unusual HTTP GET or POST requests to Gamezone theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in filename-related parameters; repeated requests probing for sensitive files like wp-config.php, /etc/passwd, or PHP session files.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme files; HTTP 200 responses to requests containing traversal sequences that should not return file content.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system files; new or modified files in the theme directory that were not part of the original installation.
• Process: PHP error logs showing include() or require() failures for unusual file paths, which may indicate failed exploitation attempts (Patchstack).

As of the time of disclosure, no official patch from ThemeREX is available for the Gamezone theme. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until an official fix is released. Site owners should consider replacing or deactivating the Gamezone theme if an update is not forthcoming, implementing web application firewall (WAF) rules to block path traversal patterns, and applying strict input validation on all filename parameters. Network-level access controls and monitoring of PHP include-related log activity are also recommended as interim measures (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 – March 1, 2026, highlighting it as part of broader WordPress ecosystem security coverage (Wordfence). No significant vendor statements from ThemeREX or notable researcher commentary beyond the Patchstack disclosure have been identified.