CVE-2026-28129: 
WordPress vulnerability analysis and mitigation

CVE-2026-28129 is a Local File Inclusion (LFI) vulnerability in the axiomthemes "Little Birdies" WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Little Birdies theme through and including version 1.3.16. The vulnerability was published on March 5, 2026, with the CVE received from Patchstack and CVSS scoring added by CISA-ADP. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper handling of filename parameters in PHP include/require statements within the Little Birdies WordPress theme (CWE-98). An attacker can manipulate user-controlled input that is passed unsanitized to a PHP file inclusion function, causing the server to include arbitrary local files. Exploitation requires high attack complexity (AC:H) but no authentication or user interaction, and is reachable over the network. Despite being classified under the "PHP Remote File Inclusion" CWE, the actual attack vector is PHP Local File Inclusion (LFI), meaning the attacker can read or execute files already present on the server rather than fetching remote resources (Patchstack).

Successful exploitation could allow an unauthenticated remote attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files (e.g., wp-config.php), credentials, or other server-side data. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, meaning an attacker could achieve information disclosure, data manipulation, or even remote code execution if exploitable PHP files (e.g., uploaded images containing PHP code) are present on the server. This could serve as a stepping stone for full WordPress site compromise or lateral movement within the hosting environment (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites using the Little Birdies theme (version ≤ 1.3.16) via tools like WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/little-birdies/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate a parameter that is passed to a PHP include() or require() function without proper sanitization.
3. Craft LFI payload: Construct a request with a path traversal payload in the vulnerable parameter (e.g., ?file=../../../../wp-config.php or ?template=../../../etc/passwd) to attempt inclusion of sensitive local files.
4. Achieve file disclosure or code execution: If the server returns the contents of the targeted file, extract credentials or configuration data. If a previously uploaded file containing PHP code (e.g., a malicious image) is accessible, include it to achieve remote code execution on the server.

• Network: Unusual HTTP GET/POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting sensitive files such as wp-config.php or /etc/passwd.
• Logs: WordPress or web server access logs showing repeated requests with file path manipulation patterns to theme-related PHP scripts; HTTP 200 responses to requests containing traversal sequences.
• File System: Unexpected access to sensitive files (e.g., wp-config.php, /etc/passwd) by the web server process; presence of newly uploaded files with double extensions (e.g., .php.jpg) in upload directories.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget) following suspicious theme file requests.

No official patch has been confirmed for versions through 1.3.16; users should check the WordPress theme repository or the axiomthemes vendor site for an updated version newer than 1.3.16 and upgrade immediately if available. As interim mitigations, administrators should disable or restrict the allow_url_include PHP directive, implement strict input validation and sanitization for all filename parameters, and deploy Web Application Firewall (WAF) rules to detect and block path traversal and file inclusion attempts. Restricting file permissions on sensitive files (e.g., wp-config.php) and monitoring web server logs for traversal patterns are also recommended (Feedly).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of February 23 – March 1, 2026, indicating it was tracked as part of routine WordPress ecosystem vulnerability monitoring (Wordfence). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator listings.