CVE-2026-28128: 
WordPress vulnerability analysis and mitigation

CVE-2026-28128 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Verse WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Verse theme up to and including 1.7.0. The vulnerability was disclosed on March 5, 2026, with the CVE received from Patchstack and CVSS v3.1 scoring added by CISA-ADP. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The root cause is improper input validation of filename parameters passed to PHP include/require statements within the ThemeREX Verse theme (CWE-98). An unauthenticated remote attacker can manipulate these filename parameters over the network to cause the application to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (AC:H), suggesting some precondition or bypass is needed, but no privileges or user interaction are required. No public proof-of-concept or detailed technical write-up has been identified at this time (Patchstack, NVD).

Successful exploitation could allow an unauthenticated attacker to read arbitrary local files on the server, potentially exposing sensitive configuration files, credentials (e.g., wp-config.php), or other sensitive data. In certain server configurations, LFI can be chained with other techniques (such as log poisoning or session file inclusion) to achieve remote code execution, leading to full system compromise. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability (Patchstack, NVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites using the ThemeREX Verse theme version 1.7.0 or earlier using tools like WPScan, Shodan, or manual inspection of theme metadata.
2. Identify vulnerable parameter: Locate the PHP include/require statement within the Verse theme that accepts user-controlled filename input, typically via a GET or POST parameter in a theme template or AJAX handler.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) as the value of the vulnerable filename parameter.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site targeting the vulnerable endpoint.
5. Retrieve sensitive data: If successful, the server will include and return the contents of the targeted local file, potentially exposing credentials, configuration data, or other sensitive information.
6. Escalate (optional): Chain the LFI with log poisoning, PHP session file inclusion, or other techniques to attempt remote code execution if server conditions permit.

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST bodies targeting WordPress theme endpoints; requests for known sensitive files such as wp-config.php or /etc/passwd via theme parameters.
• Logs: WordPress or web server access logs showing repeated requests with path traversal patterns to theme-related endpoints; HTTP 200 responses to requests containing file inclusion payloads.
• File System: Unexpected access to sensitive files (e.g., wp-config.php, /etc/passwd) reflected in file access audit logs; presence of web shells if LFI was escalated to RCE via log poisoning or similar techniques.
• Process: Unusual PHP processes spawning child processes (e.g., shell commands) if LFI was successfully escalated to remote code execution.

Users should immediately upgrade the ThemeREX Verse theme to a version later than 1.7.0, where this vulnerability has been patched. As interim mitigations, administrators should implement strict input validation and sanitization on all filename parameters used in PHP include/require statements, and apply a whitelist of allowed files for inclusion. Deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns can help block exploitation attempts. Reviewing web server and WordPress access logs for suspicious file inclusion attempts is also recommended (Patchstack).

The vulnerability was reported by Patchstack and received limited public attention, with aggregation by standard CVE tracking services and a brief mention on Mastodon via TheHackerWire. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond routine CVE publication and aggregation.