CVE-2026-28121: 
WordPress vulnerability analysis and mitigation

CVE-2026-28121 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Anderson WordPress theme (slug: andersonclinic) caused by improper control of filenames in PHP include/require statements. It affects all versions of the Anderson theme up to and including 1.4.2. The vulnerability was published on March 5, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), but the actual exploitation vector is PHP Local File Inclusion (LFI). The root cause is insufficient validation or sanitization of user-supplied input that is passed to a PHP include() or require() statement within the Anderson theme, allowing an attacker to manipulate the filename parameter to reference arbitrary files on the server. No authentication is required, though exploitation is rated as high complexity (AC:H), suggesting some precondition such as specific server configuration or knowledge of file paths may be needed. No public proof-of-concept code has been identified (Patchstack, NVD).

Successful exploitation of this LFI vulnerability could allow an unauthenticated remote attacker to read arbitrary files from the server filesystem, including sensitive configuration files (e.g., wp-config.php) containing database credentials, API keys, and other secrets. In certain server configurations (e.g., where file wrappers or log poisoning techniques are applicable), LFI can be escalated to remote code execution, resulting in full compromise of confidentiality, integrity, and availability of the affected WordPress installation (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been made (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the AncoraThemes Anderson theme (slug: andersonclinic) version 1.4.2 or earlier using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion point where user-controlled input is passed to a PHP include() or require() call without adequate sanitization.
3. Craft LFI payload: Construct an HTTP request (GET or POST) targeting the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive server-side files.
4. Extract sensitive data: If successful, the server response will include the contents of the targeted file (e.g., WordPress database credentials from wp-config.php).
5. Escalate if possible: Attempt LFI-to-RCE escalation via log poisoning (injecting PHP code into server logs then including the log file) or PHP filter wrappers (e.g., php://filter/convert.base64-encode/resource=) if the server configuration permits (Patchstack).

• Network: HTTP requests to WordPress endpoints associated with the Anderson theme containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields; requests including PHP filter wrappers such as php://filter or php://input.
• Logs: Web server access logs (Apache/Nginx) showing repeated requests with unusual filename parameters targeting theme-related endpoints; PHP error logs indicating failed file inclusion attempts referencing system paths.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process; presence of web shells in the theme directory or uploads folder if RCE escalation was achieved.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, curl, wget) if LFI was escalated to remote code execution.

No patch information is currently confirmed as available for the Anderson theme. Site administrators should immediately check whether a patched version (above 1.4.2) has been released by AncoraThemes and upgrade if so. As interim mitigations: implement Web Application Firewall (WAF) rules to block path traversal and PHP wrapper patterns in request parameters; restrict PHP file permissions to limit readable files; and consider deactivating or replacing the theme until a fix is confirmed. Monitor server logs for signs of exploitation attempts (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, indicating it received standard industry tracking attention (Wordfence). No notable individual researcher commentary or significant social media discussion has been identified beyond routine aggregation by vulnerability tracking platforms.