CVE-2026-28091: 
WordPress vulnerability analysis and mitigation

CVE-2026-28091 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Coleo WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Coleo theme through and including version 1.1.7. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and publicly disclosed on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Coleo theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters passed to these PHP file inclusion functions to load arbitrary files from the local server filesystem. The attack vector is network-based, requires no authentication or user interaction, but is rated High complexity, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). No public proof-of-concept exploit code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and execute arbitrary files from the local server filesystem, potentially exposing sensitive files such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability impacts all three security pillars — confidentiality, integrity, and availability are all rated HIGH — meaning attackers could read sensitive data, modify website content, and disrupt service availability. No authentication or user interaction is required, making any internet-exposed WordPress site running the affected theme a potential target (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Coleo theme (versions ≤ 1.1.7) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate the PHP file inclusion point within the theme — typically a URL parameter or POST field that controls which file is included/required by the theme's PHP code.
3. Craft malicious request: Submit an HTTP request with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) to trigger the LFI.
4. Extract sensitive data: Review the server's HTTP response for the contents of the included file, potentially exposing database credentials, API keys, or other configuration secrets from wp-config.php.
5. Escalate access: Use extracted credentials (e.g., database username/password) to access the WordPress database directly, enabling full site takeover, data exfiltration, or further lateral movement within the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in URL parameters; repeated requests to theme PHP files from a single IP with varying file path parameters.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal strings targeting Coleo theme endpoints; PHP error logs referencing unexpected file inclusion paths or include/require failures for system files.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other system configuration files; presence of web shells in the theme directory if LFI is chained with a file upload vulnerability.
• Process: Unusual PHP worker processes reading files outside the WordPress document root; unexpected outbound connections from the web server process if remote file inclusion is achieved.

As of the disclosure date, no official patch from ThemeREX is available for the Coleo theme. Site administrators should immediately consider deactivating and removing the Coleo theme if a patched version is not yet available. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. As a general workaround, deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns can reduce risk. Administrators should monitor ThemeREX and the WordPress theme repository for an updated version and apply it as soon as available (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability intelligence report covering the period of February 23 – March 1, 2026, highlighting it as part of broader WordPress ecosystem security monitoring (Wordfence). Patchstack, the assigning CNA, classified it as high priority and noted the potential for mass-exploit campaigns targeting this class of vulnerability. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been identified.