CVE-2026-28093: 
WordPress vulnerability analysis and mitigation

CVE-2026-28093 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Ozisti WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Ozisti theme through and including version 1.1.10, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and publicly disclosed on March 5, 2026, via Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Ozisti theme (CWE-98). An unauthenticated attacker can manipulate filename parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server. Because the vulnerability requires high attack complexity (AC:H per the CVSS vector), some precondition or specific request crafting is likely needed, though no authentication is required. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (e.g., wp-config.php) containing database credentials, which could lead to full database compromise. Depending on server configuration and available files, LFI may be escalated to remote code execution — for example, by including server log files containing attacker-injected PHP code. The CVSS score reflects high impacts to confidentiality, integrity, and availability (Patchstack).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with high CVSS scores) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Ozisti theme version ≤ 1.1.10 via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate endpoints that accept user-controlled filename or path parameters passed to PHP include/require statements.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter referencing a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Extract sensitive data: Review the HTTP response for the contents of the included file, potentially obtaining database credentials, API keys, or other sensitive configuration data.
5. Escalate to RCE (optional): If server logs or upload directories are accessible and writable, inject PHP code into a log file (log poisoning) and then include it via the LFI vector to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files (wp-config.php, /etc/passwd) in query parameters or request bodies.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded traversal patterns targeting Ozisti theme PHP files; PHP error logs indicating failed file inclusion attempts or unexpected file reads.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server log files; presence of web shells in theme directories if RCE was achieved via log poisoning.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if exploitation escalated to remote code execution.

No official patch from ThemeREX has been confirmed as of the disclosure date; the Patchstack advisory notes "No official patch available." Site owners should update the Ozisti theme to a version newer than 1.1.10 if one becomes available, or consider replacing the theme. As immediate workarounds: disable the allow_url_include PHP directive, implement a Web Application Firewall (WAF) with rules to block path traversal and LFI patterns, and apply input validation on all file inclusion parameters. Patchstack has issued a virtual patch/mitigation rule for subscribers to block exploitation attempts until an official fix is released (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, which discovered and disclosed the vulnerability, classified it as "High Priority" and noted that LFI vulnerabilities of this severity are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity.