CVE-2026-28097: 
WordPress vulnerability analysis and mitigation

CVE-2026-28097 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Artrium WordPress theme affecting all versions through 1.0.14. It stems from improper control of filenames in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported by researcher 'Bonds' on August 31, 2025, disclosed publicly by Patchstack on February 27, 2026, and assigned a CVE on March 5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is passed unsanitized to PHP include() or require() functions within the Artrium theme. An unauthenticated attacker can craft a network request that manipulates the filename parameter to traverse the file system and include sensitive local files. Exploitation requires high attack complexity (AC:H per the CVSS vector), suggesting some precondition or specific request crafting is necessary, though no authentication is required. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the server, including sensitive configuration files such as WordPress wp-config.php, which contains database credentials. This can lead to full database compromise, exposure of user data, and potentially remote code execution if the attacker can include a file containing PHP code (e.g., via log poisoning or uploaded files). The integrity and availability of the WordPress installation are also at risk, as database credential exposure could enable further lateral movement or complete site takeover (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic size or popularity, making timely remediation important (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Artrium theme version 1.0.14 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/artrium).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate endpoints where user-supplied input is passed to a PHP include() or require() function without proper sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) that manipulates the vulnerable filename parameter with path traversal sequences (e.g., ../../../../wp-config.php) to reference a target local file.
4. Retrieve sensitive files: Send the crafted request to the target server; if successful, the server will include and output the contents of the specified file, exposing credentials or other sensitive data.
5. Escalate (optional): If file upload functionality exists on the site, upload a PHP web shell, then use the LFI to include it and achieve remote code execution.

• Network: Unusual HTTP requests to theme-related endpoints containing path traversal sequences (../, ..%2F, %2e%2e%2f) in query parameters or POST body; requests targeting known sensitive files (e.g., wp-config.php, /etc/passwd).
• Logs: WordPress or web server access logs showing repeated requests to Artrium theme PHP files with anomalous parameter values; HTTP 200 responses to requests containing traversal patterns.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI escalation.

As of the disclosure date, no official patch from ThemeREX is available for the Artrium theme. Site owners should consider temporarily deactivating the Artrium theme and switching to an alternative until a patched version is released. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts. Additional mitigations include deploying a Web Application Firewall (WAF) with rules to block path traversal patterns, restricting file system permissions on the WordPress installation, and monitoring access logs for suspicious activity (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering February 23 – March 1, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, the assigning CNA, classified it as high priority and noted the risk of mass-exploit campaigns targeting this class of vulnerability. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database reporting.