CVE-2026-28107: 
WordPress vulnerability analysis and mitigation

CVE-2026-28107 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Muzicon WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Muzicon theme through 1.9.0 and was disclosed on March 5, 2026, with the CVE received from Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by CISA-ADP (Patchstack).

The vulnerability stems from improper validation of user-controlled input used in PHP include/require statements within the Muzicon theme (CWE-98), enabling PHP Local File Inclusion. Despite being classified under the 'PHP Remote File Inclusion' CWE, the actual exploitation vector is local file inclusion, where an attacker can manipulate filename parameters to include arbitrary files already present on the server. Exploitation requires no authentication and no user interaction, though it does carry high attack complexity, suggesting specific conditions or non-default configurations must be met. No public proof-of-concept or detailed technical write-up is currently available (Patchstack).

Successful exploitation could allow an unauthenticated remote attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files (e.g., wp-config.php containing database credentials), achieving remote code execution via log poisoning or uploaded file inclusion, and fully compromising the confidentiality, integrity, and availability of the affected WordPress installation. The CVSS scoring reflects high impact across all three security dimensions, indicating potential for complete system compromise (Patchstack).

As of the time of disclosure, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement further limits opportunistic exploitation (Patchstack).

Users of the ThemeREX Muzicon WordPress theme should update to a version newer than 1.9.0 if a patched release is available. If no patch is currently available, administrators should consider temporarily disabling the theme and switching to an alternative, or deploying a Web Application Firewall (WAF) to restrict access to vulnerable parameters. Monitoring the Patchstack advisory page and WordPress theme repository for patch releases is strongly recommended (Patchstack).

Wordfence noted this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements or notable researcher commentary beyond standard disclosure have been identified.