CVE-2026-28094: 
WordPress vulnerability analysis and mitigation

CVE-2026-28094 is a Local File Inclusion (LFI) vulnerability in the ThemeREX RexCoin WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the RexCoin theme through version 1.2.6 and allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and published by Patchstack on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the RexCoin theme (CWE-98). An attacker can manipulate a filename parameter passed to these statements to reference arbitrary local files on the server, enabling PHP Local File Inclusion (LFI). Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition such as specific server configuration or knowledge of file paths. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the web server, including configuration files containing database credentials, which could lead to complete database compromise. Depending on server configuration, LFI may be escalated to Remote Code Execution (RCE) by including files containing attacker-controlled PHP code (e.g., via log poisoning or uploaded files). The vulnerability has high impact on confidentiality, integrity, and availability of the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority, noting that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic size (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX RexCoin theme version 1.2.6 or earlier using tools like WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that pass user-controlled input to an include or require statement without proper sanitization.
3. Craft malicious request: Send an HTTP request (GET or POST) to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's response for the contents of the included file, potentially exposing database credentials, API keys, or other sensitive configuration data.
5. Escalate to RCE (if conditions allow): If the server logs user-controlled input (e.g., User-Agent strings) to an accessible log file, poison the log with PHP code and include it via the LFI vector to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting WordPress theme endpoints.
• Logs: WordPress or web server access logs showing requests with file path traversal patterns to theme-related PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files from the web process; newly created PHP files in the theme or uploads directory.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if LFI has been escalated to RCE via log poisoning or file upload.

As of the time of publication, no official patch is available from ThemeREX for the RexCoin theme. Site administrators should immediately consider disabling or removing the RexCoin theme until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts. Additional mitigations include deploying a Web Application Firewall (WAF) with rules to block path traversal and LFI patterns, implementing strict input validation on all user-supplied parameters, and monitoring server logs for suspicious file inclusion attempts (Patchstack).

Wordfence included CVE-2026-28094 in its weekly WordPress vulnerability report covering February 23 – March 1, 2026, highlighting it as part of broader WordPress ecosystem security monitoring. Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and issued a virtual mitigation rule for its users. No significant broader media coverage or notable researcher commentary beyond these sources has been identified.