CVE-2026-28124: 
WordPress vulnerability analysis and mitigation

CVE-2026-28124 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Notarius WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Notarius theme through version 1.9. The vulnerability was published on March 5, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), as assessed by CISA-ADP (Patchstack, NVD).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Notarius theme (CWE-98). An attacker can manipulate a filename parameter to cause the PHP interpreter to include arbitrary local files from the server's filesystem. The attack vector is network-based, requires no authentication or user interaction, but has high attack complexity. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation could allow an unauthenticated remote attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files (e.g., wp-config.php containing database credentials), achieving code execution, and fully compromising the web application and underlying server. The vulnerability has high impact on confidentiality, integrity, and availability. In environments where file upload is possible, LFI can be chained to achieve remote code execution, enabling lateral movement within the hosting environment (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Notarius theme (version ≤ 1.9) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/notarius/style.css).
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that accept user-controlled input for file inclusion (e.g., a page, template, or file parameter in a theme component).
3. Craft LFI payload: Construct a request with a path traversal payload targeting sensitive local files, such as ../../../../wp-config.php or /etc/passwd, injected into the vulnerable parameter.
4. Send malicious request: Submit the crafted HTTP GET or POST request to the vulnerable endpoint on the target WordPress site.
5. Retrieve sensitive data or escalate: If successful, the server returns the contents of the included file, exposing credentials or other sensitive data. If file upload is available, chain with an uploaded PHP webshell to achieve remote code execution.

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters targeting the Notarius theme endpoints; requests for sensitive files like wp-config.php or /etc/passwd via theme parameters.
• Logs: WordPress or web server access logs showing repeated requests to theme PHP files with suspicious file, page, or template parameters containing directory traversal strings; HTTP 200 responses to requests that should not return file contents.
• File System: Unexpected PHP webshell files uploaded to the WordPress uploads directory or theme directory if LFI is chained with file upload.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if code execution is achieved via LFI chaining.

Users of the AncoraThemes Notarius WordPress theme should upgrade to a version newer than 1.9 if a patched release becomes available. As of the disclosure date, no official patch has been confirmed; in the interim, site administrators should consider deactivating the theme and switching to an alternative, or implementing Web Application Firewall (WAF) rules to block path traversal and file inclusion attempts. Applying the principle of least privilege to web server file system permissions can limit the impact of exploitation. Monitoring for suspicious requests targeting theme parameters is also recommended (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, highlighting it as part of a broader set of theme-related issues. A post on Mastodon by @thehackerwire noted the vulnerability shortly after disclosure. Coverage has been limited to automated vulnerability aggregators and security databases, with no significant vendor statements or major media coverage observed (Wordfence).