CVE-2026-28096: 
WordPress vulnerability analysis and mitigation

CVE-2026-28096 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX WealthCo WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects WealthCo versions up to and including 2.18, with no official patch available as of the time of disclosure. The vulnerability was reported by researcher "Bonds" on August 31, 2025, and published by Patchstack on February 27, 2026, with CVE assignment on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the WealthCo theme (CWE-98). An unauthenticated remote attacker can manipulate file path parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem, potentially exposing their contents. The attack vector is network-based, requires no privileges or user interaction, but has high attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the web server's filesystem, including sensitive configuration files such as wp-config.php containing database credentials, which could lead to complete database compromise. The CVSS assessment reflects high confidentiality, integrity, and availability impacts — meaning attackers could not only exfiltrate sensitive data but potentially leverage exposed credentials for further lateral movement or site takeover. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code has been observed, and there is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns it is the type of vulnerability commonly leveraged in mass WordPress exploit campaigns (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the WealthCo theme (version ≤ 2.18) via web crawlers, Shodan, or WordPress-specific scanning tools such as WPScan.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion point — a parameter or request that is passed unsanitized to a PHP include/require statement within the WealthCo theme files.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated file path parameter (e.g., path traversal sequences like ../../wp-config.php) targeting the vulnerable endpoint.
4. Read sensitive files: The server includes and outputs the contents of the specified local file, such as wp-config.php, exposing database credentials, authentication keys, and salts.
5. Escalate access: Use exposed database credentials to access the WordPress database directly, enabling account takeover, content modification, or further lateral movement within the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to WealthCo theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies; unexpected outbound connections from the web server.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting theme PHP files; PHP error logs indicating failed or successful file inclusion of sensitive paths (e.g., /etc/passwd, wp-config.php).
• File System: Unexpected new files (e.g., web shells) written to the WordPress theme or upload directories; modification timestamps on core WordPress files changing unexpectedly.
• Application: WordPress admin accounts created without authorization; unexpected changes to site content or database credentials; signs of database credential reuse from external IPs (Patchstack).

No official patch from ThemeREX is available for WealthCo beyond version 2.18 as of the disclosure date; users should monitor the vendor for updates. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. As interim measures: disable the WealthCo theme if not essential, set allow_url_include = Off in php.ini, implement Web Application Firewall (WAF) rules to block path traversal patterns, and restrict file system permissions to limit what the web server process can read. Monitor web server and PHP error logs for signs of exploitation (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, classifies it as high priority and warns it is the type of flaw used in mass WordPress exploit campaigns. The CVE was noted on social media via automated CVE notification accounts (e.g., CVEnew on Nitter) shortly after publication. No significant vendor statement from ThemeREX or broader media coverage has been identified at this time (Patchstack).