CVE-2026-28095: 
WordPress vulnerability analysis and mitigation

CVE-2026-28095 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Marcell WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Marcell theme through and including version 1.2.14. The vulnerability was reported by security researcher "Bonds" on August 31, 2025, and publicly disclosed on February 27, 2026, via Patchstack, with NVD publication on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The root cause is improper control of filename parameters used in PHP include/require statements within the Marcell theme (CWE-98), allowing an attacker to manipulate file path inputs to include arbitrary local files on the server. The attack vector is network-based, requires no authentication (unauthenticated), and no user interaction, though it carries high attack complexity. An attacker supplies a crafted filename or path parameter to a vulnerable theme endpoint, causing the PHP interpreter to include and potentially execute a local file of the attacker's choosing. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation of this LFI vulnerability could allow an unauthenticated attacker to read sensitive local files on the web server, such as WordPress configuration files (wp-config.php) containing database credentials, potentially enabling full database takeover. Beyond information disclosure, if the attacker can control file content (e.g., via log poisoning or uploaded files), the LFI could be escalated to remote code execution, compromising the confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has classified it as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic size (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Marcell theme version ≤ 1.2.14 via tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate endpoints where user-supplied input is passed unsanitized to a PHP include() or require() statement.
3. Craft malicious request: Send an HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Retrieve sensitive data: If successful, the server response will include the contents of the targeted local file, potentially exposing database credentials or other sensitive configuration data.
5. Escalate to RCE (optional): If file upload functionality exists or server logs are writable, inject PHP code into a log file or uploaded file, then use the LFI to include and execute it, achieving remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal patterns targeting theme PHP files; PHP error logs indicating failed file inclusion attempts referencing unexpected file paths.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server log files; presence of PHP web shells in the uploads directory or theme folder.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if LFI has been escalated to RCE via log poisoning or file upload abuse.

As of the disclosure date, no official patch has been released by ThemeREX for the Marcell theme. Site owners should update the theme to a version newer than 1.2.14 if and when a patched release becomes available. In the interim, Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for Patchstack-protected sites. Additional workarounds include implementing strict server-side input validation and sanitization for any parameters influencing file inclusion, disabling allow_url_include in php.ini, and restricting web server file access permissions. Removing or replacing the vulnerable theme is also a viable option if no patch is forthcoming (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability intelligence report covering the period of February 23 – March 1, 2026, highlighting it as part of broader WordPress theme security concerns. Patchstack, the assigning CNA, classified it as high priority and issued a virtual mitigation rule given the absence of an official patch. No significant broader media coverage or notable researcher commentary beyond these standard vulnerability tracking reports has been identified.