Description Summary:
The ThemeREX Abelle WordPress theme is susceptible to unauthenticated PHP object injection, potentially enabling remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection flaw in the ThemeREX Abelle theme allows for potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65573

Affected Software: ThemeREX Abelle

Affected Versions: <= 1.22

Vulnerability: The software contains a deserialization of untrusted data vulnerability (CWE-502) that can be triggered by an unauthenticated attacker. This flaw permits the injection of malicious objects, which can lead to arbitrary code execution within the WordPress environment.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows remote attackers to gain control over the affected application. This could result in the theft of database credentials, unauthorized access to user data, and the deployment of malware.

Remediation Plan

Immediate Action: Apply the latest security update released by ThemeREX for the Abelle theme. If an official update is not available, remove the theme from the production environment to eliminate the attack surface.

Proactive Monitoring: Audit server logs for requests that attempt to pass serialized data to theme functions. Monitor application performance for signs of unauthorized background processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out malicious traffic that targets deserialization entry points.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this vulnerability highly attractive to automated scanning tools.

Analyst Recommendation

Given the critical nature of this vulnerability, immediate patching is required to prevent unauthorized system access. Security teams should verify that the theme is updated to the latest version and ensure that no malicious artifacts persist on the server.

Description Summary:
The ThemeREX Verse theme contains a local file inclusion vulnerability due to improper control of filenames used in PHP include statements.

Executive Summary:
A local file inclusion vulnerability in the ThemeREX Verse theme allows unauthenticated attackers to potentially read sensitive files or execute code on the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-28128

Affected Software: ThemeREX Verse

Affected Versions: 0 through 1.7.0

Vulnerability: This vulnerability involves improper input validation in PHP include or require statements, which allows an unauthenticated attacker to include local files from the server. The flaw stems from CWE-98 and can lead to unauthorized information disclosure or remote code execution depending on the server configuration.

Business Impact

The exploitation of this vulnerability poses a significant risk to organizational data and system integrity. With a CVSS score of 8.1, this flaw is categorized as high severity because it enables an attacker to bypass access controls and potentially gain full control over the web application environment. Unauthorized access to server-side files could lead to the compromise of database credentials, configuration files, and proprietary application logic.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable or remove the ThemeREX Verse theme if it is not strictly required for business operations. If the theme must remain active, contact the vendor for guidance on available security patches or updates.

Proactive Monitoring: Security teams should monitor web server access logs for unusual patterns, such as directory traversal sequences or attempts to access common sensitive file paths like /etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns in HTTP requests.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, the requirement for specific server configurations to achieve full code execution may limit its widespread exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion vulnerabilities, this issue should be treated with urgency. Organizations using the ThemeREX Verse theme must conduct an immediate inventory check and restrict access to the affected component until a vendor-supplied update is verified and applied.

Description Summary:
ThemeREX Dr.Patterson is affected by a local file inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Dr.Patterson WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28120

Affected Software: ThemeREX Dr.Patterson

Affected Versions: 0 through 1.3.2

Vulnerability: The theme fails to properly sanitize user-supplied input used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw can be triggered by unauthenticated remote attackers.

Business Impact

Successful exploitation allows an attacker to include arbitrary files on the server, potentially leading to the exposure of sensitive configuration files or the execution of malicious code. Given the CVSS score of 8.1, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the host system. Such compromises often lead to full site takeover and unauthorized access to backend databases.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate the Dr.Patterson theme or restrict access to the affected site until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack payloads and directory traversal attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the high CVSS score necessitates proactive mitigation to prevent potential future exploitation.

Analyst Recommendation

The vulnerability in ThemeREX Dr.Patterson presents a severe security risk due to the potential for unauthorized file access and remote code execution. Security teams must prioritize monitoring for anomalous traffic and prepare to update the theme as soon as the vendor releases a fix. Until that time, isolating the affected application remains the most effective strategy to prevent compromise.

Description Summary:
The ThemeREX Muzicon theme is vulnerable to local file inclusion due to improper control of filenames used in PHP include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Muzicon WordPress theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2026-28107

Affected Software: ThemeREX Muzicon

Affected Versions: 0 through 1.9.0

Vulnerability: The flaw is categorized as CWE-98, involving improper control of filenames for include or require statements in PHP, which allows an unauthenticated attacker to perform local file inclusion.

Business Impact

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, credentials, or other internal data residing on the web server. Given the CVSS score of 8.1, the potential for total compromise of confidentiality, integrity, and availability is significant, posing a critical risk to business continuity and data privacy.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or restrict access to the affected site until a fix is released by ThemeREX.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns or unusual file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for full system impact, despite the requirement for specific environmental conditions to trigger the flaw.

Analyst Recommendation

The vulnerability presents a severe risk to the integrity of the hosting environment. Organizations utilizing the Muzicon theme should treat this as a high-priority incident and move to mitigate the exposure by disabling the theme or implementing robust perimeter filtering until the vendor provides a formal security update.

Description Summary:
The Good Energy WordPress theme contains a PHP Object Injection vulnerability due to insecure deserialization of untrusted data, allowing unauthenticated remote code execution.

Executive Summary:
A critical deserialization vulnerability in the Good Energy WordPress theme allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28105

Affected Software: ThemeREX Good Energy - Ecology & Renewable Energy WordPress Theme

Affected Versions: n/a through 1.7.7

Vulnerability: This is a Deserialization of Untrusted Data vulnerability (CWE-502). By providing malicious serialized objects, an unauthenticated attacker can trigger code execution within the context of the web server.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. An attacker can achieve complete server compromise, leading to total loss of confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server infrastructure.

Remediation Plan

Immediate Action: As no patch is currently available, immediately deactivate or remove the Good Energy theme from all production WordPress environments.

Proactive Monitoring: Review web server access logs for requests containing serialized PHP objects or suspicious POST parameters that do not conform to expected application traffic.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block requests containing serialized PHP objects that attempt to exploit deserialization flaws.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The mechanism of PHP object injection is a known, high-impact vector for remote code execution.

Analyst Recommendation

Due to the critical nature of remote code execution vulnerabilities, the affected theme should be removed immediately. Do not resume use of this theme until the vendor releases an update explicitly addressing this deserialization flaw.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Save Life theme allows unauthenticated attackers to manipulate file paths in include statements, potentially leading to unauthorized file access.

Executive Summary:
The ThemeREX Save Life theme is vulnerable to Local File Inclusion, which may allow an unauthenticated attacker to read sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-28098

Affected Software: ThemeREX Save Life

Affected Versions: 0 through 1.2.13

Vulnerability: The theme contains an improper control of filenames for include or require statements, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to perform Local File Inclusion (LFI) by manipulating input parameters.

Business Impact

A successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, source code, or credentials stored on the web server. With a CVSS score of 8.1, the risk is classified as High due to the potential for full confidentiality, integrity, and availability impact, which could result in a complete compromise of the affected web application environment.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable the Save Life theme or switch to a secure alternative until an official update is released by ThemeREX.

Proactive Monitoring: Review web server access and error logs for suspicious directory traversal patterns, such as sequences containing '../' or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters or unexpected file path inclusions targeting the theme directory.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the nature of Local File Inclusion flaws makes them highly dangerous if discovered by malicious actors.

Analyst Recommendation

Given the High severity of this vulnerability, immediate defensive action is required. Organizations using the ThemeREX Save Life theme must prioritize removing or securing the component to prevent potential unauthorized access. Monitoring for signs of attempted exploitation remains a critical secondary measure while awaiting a vendor-supplied resolution.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Artrium WordPress theme allows unauthenticated attackers to manipulate file paths in include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Artrium theme allows unauthenticated attackers to potentially access sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28097

Affected Software: ThemeREX Artrium

Affected Versions: 0 through 1.0.14

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw stemming from improper control of filenames used in PHP include statements. An unauthenticated attacker can leverage this weakness to include unauthorized files, leading to potential information disclosure or remote code execution depending on the server configuration.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational data and system integrity. With a CVSS score of 8.1, this high-severity flaw could allow an attacker to read sensitive configuration files, including database credentials, or achieve remote code execution, which may lead to a total compromise of the affected web server and its hosted content.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Artrium theme if it is not mission-critical. If the theme must remain active, contact the vendor for an urgent security update or identify an alternative theme.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access common configuration files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows an attacker to bypass standard file access controls via the PHP include mechanism.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion vulnerabilities, this issue should be treated as a priority for remediation. Organizations using the Artrium theme must take immediate steps to restrict access or remove the vulnerable component until a secure version is provided by the vendor.

Description Summary:
The ThemeREX WealthCo WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX WealthCo theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28096

Affected Software: ThemeREX WealthCo

Affected Versions: 0 through 2.18

Vulnerability: This vulnerability is a local file inclusion (CWE-98) flaw where the theme fails to properly validate user-supplied input before passing it to include or require statements. An unauthenticated attacker can exploit this to access or execute arbitrary files on the server.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.1, the high potential for full system compromise and unauthorized data access poses a significant threat to organizational confidentiality and integrity.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, users should immediately deactivate and remove the WealthCo theme until a vendor-supplied update is available.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing directory traversal patterns or unusual file paths targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common local file inclusion signatures and unauthorized access attempts to PHP files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct server file interaction without requiring authentication.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent unauthorized access to the underlying server infrastructure. Until the vendor releases a secure update, the most effective mitigation is to discontinue the use of the WealthCo theme. Organizations should prioritize removing this component to eliminate the attack surface entirely.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Marcell theme allows unauthenticated attackers to include arbitrary local files via improper control of filename parameters.

Executive Summary:
The ThemeREX Marcell theme contains a local file inclusion vulnerability that could allow an unauthenticated attacker to compromise system files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28095

Affected Software: ThemeREX Marcell

Affected Versions: 0 through 1.2.14

Vulnerability: This vulnerability, categorized as CWE-98, arises from improper handling of filenames in include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to full system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation could allow unauthorized access to sensitive configuration files, source code, or internal data, leading to severe reputational damage and potential loss of data integrity.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should review the vendor advisory and monitor for updates to the Marcell theme, or consider disabling the theme until a secure version is released.

Proactive Monitoring: Security teams should examine server access logs for suspicious patterns, such as directory traversal characters or unexpected file path requests directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unauthorized file inclusion requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for total technical impact, though the attack requires specific environmental conditions to achieve successful exploitation.

Analyst Recommendation

Given the high severity of this file inclusion flaw, administrators must treat this as a significant security risk. We recommend auditing current installations of the ThemeREX Marcell theme and ensuring that the site is protected by a WAF while awaiting a formal patch from the vendor.

Description Summary:
ThemeREX RexCoin is susceptible to a local file inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
The ThemeREX RexCoin theme contains a critical local file inclusion vulnerability that could allow an unauthenticated attacker to read arbitrary files or execute code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28094

Affected Software: ThemeREX RexCoin

Affected Versions: 0 through 1.2.6

Vulnerability: This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in PHP file inclusion functions. The flaw allows an unauthenticated attacker to manipulate file paths to include local files, potentially leading to information disclosure or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it grants unauthorized access to sensitive application files and server-side configuration data. With a CVSS score of 8.1, the vulnerability is considered High, as it could lead to full system compromise, loss of data integrity, and significant operational downtime.

Remediation Plan

Immediate Action: As no official patch version is currently confirmed, administrators should immediately deactivate the RexCoin theme if it is not strictly required for business operations. If the theme is necessary, isolate the affected web server from external networks until a vendor-supplied update is verified and installed.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's exploitability is dependent on the application configuration and the ability of an attacker to reach the vulnerable PHP inclusion points.

Analyst Recommendation

Given the potential for complete system compromise via file inclusion, this vulnerability must be treated with high urgency. Administrators are advised to monitor the official Patchstack database for the release of a security update and apply it immediately upon availability. In the interim, limiting access to the web interface and implementing strict file system permissions are essential to containing the risk.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Ozisti WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
The ThemeREX Ozisti WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary code or access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-28093

Affected Software: ThemeREX Ozisti

Affected Versions: 0 through 1.1.10

Vulnerability: This vulnerability, identified as CWE-98, involves improper control of filenames used in include or require statements. An unauthenticated attacker can manipulate the input to perform Local File Inclusion, potentially resulting in full system compromise.

Business Impact

A successful exploit of this vulnerability allows for unauthorized file access and potential remote code execution. Given the CVSS score of 8.1, this is a high-severity issue that could lead to complete system compromise, data theft, and loss of service integrity. Organizations using this theme are at significant risk of unauthorized access to sensitive configuration files or application data.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Ozisti theme until a security update is released by ThemeREX.

Proactive Monitoring: Monitor server access logs for unusual requests containing directory traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe due to the potential for code execution, it currently lacks evidence of active weaponization.

Analyst Recommendation

Given the potential for complete system compromise via Local File Inclusion, this vulnerability presents a high risk to the availability and confidentiality of the host environment. Administrators must prioritize the removal or restriction of the affected theme immediately. Continue to monitor the vendor advisory for the release of a patched version and apply it as soon as it becomes available.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the ThemeREX Sounder WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
The ThemeREX Sounder theme contains a critical Local File Inclusion vulnerability that could allow an unauthenticated attacker to read sensitive files or execute code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-28092

Affected Software: ThemeREX Sounder

Affected Versions: 1.3.11 and prior

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw occurring within the theme's PHP include/require statements. It allows an unauthenticated attacker to manipulate file paths to access or include unauthorized local files, potentially leading to full system compromise.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it allows for unauthorized access to sensitive application configuration files, database credentials, or system files. Given the CVSS score of 8.1, this is a high-severity issue that could result in total compromise of the web application and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the Sounder theme to the latest available version beyond 1.3.11 to patch the vulnerable file inclusion logic. If an update is not immediately available, disable the theme until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions, specifically targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal sequences and LFI attempt payloads directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the high attack complexity noted in the CVSS vector suggests that successful exploitation requires specific conditions or non-standard configurations to trigger the flaw reliably.

Analyst Recommendation

The vulnerability in the ThemeREX Sounder theme represents a significant security risk due to its potential to facilitate unauthorized file access and remote code execution. Security teams should prioritize identifying all instances of the Sounder theme within their environment and ensure they are updated to a non-vulnerable version immediately to prevent potential exploitation.

Description Summary:
The ThemeREX Coleo WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Coleo theme exposes the underlying server to potential unauthorized file access and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-28091

Affected Software: ThemeREX Coleo

Affected Versions: 0 through 1.1.7

Vulnerability: This vulnerability, classified as CWE-98, allows an unauthenticated attacker to manipulate file paths within include or require statements. By injecting malicious input, an attacker can force the application to include arbitrary local files, potentially leading to sensitive data disclosure or execution of unauthorized code.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. With a CVSS score of 8.1, the potential for an attacker to read sensitive configuration files or execute arbitrary code could lead to a complete system compromise, resulting in data breaches and operational downtime.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately disable or remove the ThemeREX Coleo theme until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or unexpected file extensions being passed to theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal patterns and attempts to access sensitive system files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently confirmed, the nature of local file inclusion flaws makes them high-value targets for automation; therefore, prompt mitigation is advised.

Analyst Recommendation

Given the high CVSS score and the critical nature of local file inclusion, this vulnerability must be treated as a priority. Administrators should migrate to an alternative theme or maintain the software in a disabled state until the vendor provides a verified security update that addresses the improper filename control.

Description Summary:
The ThemeREX Gamezone WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Gamezone theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28090

Affected Software: ThemeREX Gamezone

Affected Versions: 0 through 1.1.11

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) where an unauthenticated attacker can manipulate input parameters to include unauthorized files on the server. The vulnerability exists because the theme fails to validate user-supplied input before passing it to include or require functions in PHP.

Business Impact

Successful exploitation of this vulnerability can result in the exposure of sensitive configuration files, source code, or internal data. Given the CVSS score of 8.1, the potential for unauthorized file access represents a significant risk to the confidentiality and integrity of the hosting server and the WordPress application.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or uninstall the Gamezone theme if it is not essential for business operations. Monitor the vendor website for the release of a security update that addresses this file inclusion flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or references to unexpected system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the WordPress installation.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is accessible to unauthenticated attackers, the high attack complexity noted in the CVSS vector suggests that successful exploitation requires specific environmental conditions.

Analyst Recommendation

Given the severity of potential local file inclusion, administrators should prioritize securing the affected environment immediately. If an update is not yet provided by ThemeREX, restricting file access and implementing strict input validation via a WAF is essential to mitigate the risk of unauthorized server-side file access.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Daiquiri theme allows unauthenticated attackers to include arbitrary files, potentially leading to unauthorized data access or code execution.

Executive Summary:
The ThemeREX Daiquiri theme is vulnerable to Local File Inclusion, which could allow unauthenticated attackers to access sensitive system files or execute malicious code.

Vulnerability Details

CVE-ID: CVE-2026-28089

Affected Software: ThemeREX Daiquiri

Affected Versions: 0 through 1.2.4

Vulnerability: The theme suffers from an improper control of filenames for include statements (CWE-98), allowing an unauthenticated attacker to perform Local File Inclusion. This flaw enables the inclusion of arbitrary PHP files from the local server filesystem.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the host environment. With a CVSS score of 8.1, the high severity reflects the potential for total system compromise, including unauthorized access to sensitive application data and the ability for an attacker to execute arbitrary commands under the context of the web server.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Daiquiri theme if it is not business-critical or switch to a secure alternative.

Proactive Monitoring: Review web server access and error logs for suspicious path traversal patterns or unexpected file inclusion requests targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal and file inclusion attack strings to mitigate the risk until a vendor update is applied.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous as it bypasses standard authentication mechanisms to interact directly with the server file system.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, immediate action is required to prevent potential compromise. Organizations currently utilizing the ThemeREX Daiquiri theme must prioritize deactivation or the implementation of strict WAF filtering until the vendor releases a secure update to resolve the file inclusion flaw.

Description Summary:
The ThemeREX Aqualots WordPress theme contains a local file inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Aqualots WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28088

Affected Software: ThemeREX Aqualots

Affected Versions: 0 through 1.1.6

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can supply malicious input to the vulnerable parameter to access or execute arbitrary files on the local filesystem.

Business Impact

The ability for an unauthenticated attacker to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the affected system. Exploitation could lead to the exposure of sensitive configuration files, database credentials, or remote code execution, which may result in full system compromise and significant reputational damage. The CVSS score of 8.1 reflects the high severity of this potential impact.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the Aqualots theme until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences or attempts to include unauthorized local files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the underlying flaw is inherently dangerous and should be addressed as a high priority.

Analyst Recommendation

Given the high severity of this local file inclusion vulnerability, security teams must treat this as an urgent matter. Immediate deactivation of the vulnerable theme is the safest course of action until an official patch is provided by ThemeREX. Ensure that all web server logs are reviewed for evidence of past exploitation attempts.

Description Summary:
ThemeREX Filmax is vulnerable to Local File Inclusion via improper control of filenames for include or require statements in PHP, potentially allowing unauthorized file access or execution.

Executive Summary:
A Local File Inclusion vulnerability in the ThemeREX Filmax theme allows unauthenticated attackers to potentially access or execute arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2026-28087

Affected Software: ThemeREX Filmax

Affected Versions: 0 through 1.1.11

Vulnerability: The flaw is a Local File Inclusion (LFI) vulnerability (CWE-98) occurring due to improper handling of filename inputs in include or require statements. This vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting a high severity risk. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary PHP code, leading to a complete compromise of the web application, potential data exfiltration, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately disable or remove the Filmax theme if it is not essential for business operations.

Proactive Monitoring: Review web server access logs for requests containing suspicious path traversal sequences or attempts to include local system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts, which can help mitigate the risk while awaiting a vendor security update.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is classified as high severity, it requires specific conditions to trigger, though the absence of authentication requirements makes it a priority for remediation.

Analyst Recommendation

The presence of a Local File Inclusion vulnerability in a WordPress theme poses a critical risk to the integrity and confidentiality of the hosting environment. Organizations currently using ThemeREX Filmax must prioritize moving to a secure alternative or disabling the theme entirely until the vendor releases a verified patch. Monitoring for unauthorized access attempts is essential until the software is updated.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Run Gran theme allows unauthenticated attackers to include arbitrary local files via improper filename control in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Run Gran theme could allow unauthenticated attackers to execute arbitrary code or access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-28086

Affected Software: ThemeREX Run Gran

Affected Versions: 0 through 2.0

Vulnerability: This flaw is caused by improper control of filenames in PHP include or require statements, categorized as CWE-98. An unauthenticated attacker can exploit this via the run-gran component to perform local file inclusion, potentially leading to unauthorized data access or remote code execution.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational data integrity and system availability. Given the CVSS score of 8.1, the potential for an unauthenticated attacker to read sensitive configuration files or execute arbitrary scripts on the underlying server could result in full site compromise, data breaches, and significant operational disruption.

Remediation Plan

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately disable or remove the affected Run Gran theme from all WordPress installations until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing directory traversal patterns or unexpected file paths directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file inclusion attempts and directory traversal payloads to provide virtual patching until the theme is updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for exploitation.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for unauthenticated remote exploitation. It is imperative that administrators identify all instances of the ThemeREX Run Gran theme and deactivate them immediately to prevent unauthorized access. Monitor vendor communications closely for the release of a security patch and perform a thorough audit of the environment once the theme is updated or replaced.

Description Summary:
ThemeREX Mahogany contains a local file inclusion vulnerability via improper control of filenames in PHP include statements, potentially allowing unauthorized file access.

Executive Summary:
A local file inclusion vulnerability in the ThemeREX Mahogany theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28085

Affected Software: ThemeREX Mahogany

Affected Versions: 0 through 2.9

Vulnerability: This flaw is a local file inclusion (LFI) vulnerability stemming from CWE-98, where the application fails to properly sanitize user input used in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high level of severity due to the potential for full compromise of the application server. Successful exploitation allows an attacker to read sensitive configuration files or execute arbitrary PHP code, leading to complete data exfiltration, service disruption, or total system takeover.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or uninstall the Mahogany theme if it is not strictly required. If the theme must remain in use, contact the vendor for an urgent security update or migrate to a secure alternative.

Proactive Monitoring: Monitor server access logs for unusual URL patterns, specifically those containing directory traversal sequences like dot-dot-slash (../) or requests targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common path traversal and local file inclusion attack vectors targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known patch is concerning, the high CVSS score reflects the dangerous nature of LFI vulnerabilities when they occur in themes that handle file includes improperly.

Analyst Recommendation

Given the high severity and the potential for full system compromise, organizations currently running the Mahogany theme should treat this as a critical priority. Until the vendor releases a definitive security patch, removing the theme is the only effective way to eliminate the risk of unauthorized file access and potential remote code execution.

Description Summary:
The ThemeREX Bazinga WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
The ThemeREX Bazinga WordPress theme contains a critical local file inclusion vulnerability that allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28084

Affected Software: ThemeREX Bazinga

Affected Versions: 0 through 1.1.9

Vulnerability: This vulnerability, classified as CWE-98, occurs when the theme fails to properly sanitize user input before passing it to file inclusion functions. An unauthenticated attacker can exploit this flaw to perform local file inclusion, potentially leading to full system compromise.

Business Impact

A successful exploitation of this local file inclusion vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. With a CVSS score of 8.1, the vulnerability is categorized as High, as it allows attackers to bypass security controls to access sensitive server files or execute malicious PHP code, which may result in full site takeover and significant data breach.

Remediation Plan

Immediate Action: Since a specific patch is not confirmed in the available data, administrators should immediately deactivate or remove the Bazinga theme if it is not business-critical. Users should monitor the vendor website for the release of version 1.1.10 or higher.

Proactive Monitoring: Review web server error logs and access logs for suspicious patterns, such as directory traversal attempts or requests for non-existent PHP files in theme directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to block directory traversal sequences, such as dot-dot-slash patterns, to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant due to the lack of required authentication for the affected PHP functions.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion flaws, immediate action is required to protect the integrity of the hosting environment. Organizations currently utilizing the Bazinga theme should prioritize its removal or restriction until a secure version is verified and deployed.

Description Summary:
The ThemeREX Windsor theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A critical Local File Inclusion vulnerability in the ThemeREX Windsor theme allows unauthenticated attackers to potentially read or execute arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28081

Affected Software: ThemeREX Windsor

Affected Versions: 0 through 2.5.0

Vulnerability: This flaw is classified as a Local File Inclusion (CWE-98), occurring when the application improperly handles user-supplied input used in PHP include or require statements. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is exploitable by an unauthenticated attacker over the network.

Business Impact

The ability for an attacker to perform Local File Inclusion poses a severe risk to business operations, as it may result in the unauthorized disclosure of sensitive configuration files or the execution of malicious code. Given the high CVSS score of 8.1, this vulnerability could lead to a full system compromise, resulting in significant data breaches and prolonged service outages.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, users should immediately deactivate or remove the Windsor theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and path traversal attempts directed at the WordPress environment.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the exploit requires specific conditions to trigger, the potential for remote code execution makes this a high-priority risk for WordPress administrators.

Analyst Recommendation

This vulnerability presents a substantial risk to the integrity and confidentiality of the affected WordPress site. Administrators must prioritize the removal of the vulnerable theme or restrict access to the affected components until a vendor-supplied security patch is released and verified. Failure to address this flaw could provide attackers with an unrestricted pathway into the underlying server infrastructure.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Vapester WordPress theme allows unauthenticated attackers to include arbitrary files on the server via improper filename control.

Executive Summary:
The ThemeREX Vapester WordPress theme is susceptible to a local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28077

Affected Software: ThemeREX Vapester

Affected Versions: 0 through 1.1.10

Vulnerability: This vulnerability, classified as CWE-98, occurs due to improper control of filenames used in include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational data and system integrity. By reading arbitrary files from the server, an attacker may extract configuration files, database credentials, or sensitive application source code, which could facilitate further compromise of the entire web environment. Given the CVSS score of 8.1, the vulnerability is classified as High and requires immediate attention to prevent total system compromise.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Vapester theme if it is not business-critical. If the theme is required, restrict access to the web server and monitor for suspicious file inclusion patterns until an official security update is released by ThemeREX.

Proactive Monitoring: Review web server access logs for unusual requests containing directory traversal sequences or attempts to include non-PHP files. Monitor for spikes in unauthorized error codes that may suggest automated scanning for this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal and local file inclusion attempts. Ensure the PHP configuration (php.ini) has allow_url_include disabled to mitigate the impact of remote file inclusion vectors.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for total impact on confidentiality, integrity, and availability, even though the attack complexity is rated as high.

Analyst Recommendation

This vulnerability represents a significant security risk for WordPress installations using the Vapester theme. Administrators must prioritize the containment of this threat by disabling the affected component until a vendor-supplied update is verified and applied. Maintaining a robust backup and monitoring strategy is essential while awaiting a formal patch.

Description Summary:
The ThemeREX Pizza House WordPress theme is vulnerable to PHP object injection via insecure deserialization of untrusted data, potentially leading to remote code execution.

Executive Summary:
A critical deserialization vulnerability in the ThemeREX Pizza House WordPress theme allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28074

Affected Software: ThemeREX Pizza House

Affected Versions: 0 through 1.4.0

Vulnerability: This is a deserialization of untrusted data (CWE-502) vulnerability. The flaw allows unauthenticated, remote attackers to inject malicious PHP objects, which can be leveraged to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. Given the CVSS score of 9.8, the business impact is severe, including potential data exfiltration, complete system compromise, and the ability to pivot into the underlying server infrastructure.

Remediation Plan

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the Pizza House theme from their environment until a security update is provided by the vendor.

Proactive Monitoring: Review web server and WordPress application logs for suspicious serialized strings or unusual post requests directed at theme-specific files.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts or common PHP object injection payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dangerous due to its unauthenticated nature and the potential for full system compromise.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the critical severity of the vulnerability, immediate removal of the theme is the only effective mitigation. Organizations should prioritize migrating to a secure, actively maintained theme to eliminate this risk entirely.

Description Summary:
The ThemeREX Le Truffe WordPress theme is susceptible to a local file inclusion vulnerability via improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Le Truffe WordPress theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2026-28069

Affected Software: ThemeREX Le Truffe

Affected Versions: 0 through 1.1.7

Vulnerability: This flaw is a Local File Inclusion (LFI) vulnerability categorized under CWE-98, which occurs due to improper sanitization of filenames passed to PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. Successful attackers can read sensitive system files, configuration files, or potentially execute arbitrary code on the server, which may lead to a complete compromise of the web application. Given the CVSS score of 8.1, the potential for total impact necessitates immediate attention despite the high attack complexity.

Remediation Plan

Immediate Action: Check the WordPress dashboard or the vendor website for an update beyond version 1.1.7; if no patch is available, consider switching to a different theme or disabling the affected software.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as "../", which are often indicative of LFI attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion requests to the server.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high attack complexity, the nature of file inclusion flaws makes them a frequent target for automated scanning and exploitation.

Analyst Recommendation

Given the severity of potential file inclusion attacks, administrators should prioritize replacing or updating the Le Truffe theme. If an official patch has not been released by ThemeREX, the theme should be deactivated immediately to prevent unauthorized access or system-wide compromise while a permanent fix is sought.

Description Summary:
The ThemeREX Rhythmo WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Rhythmo theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28068

Affected Software: ThemeREX Rhythmo

Affected Versions: 0 through 1.3.4

Vulnerability: This vulnerability is a local file inclusion (CWE-98) flaw where the application fails to properly sanitize user input before passing it to include or require functions. The vulnerability is accessible to unauthenticated attackers over the network.

Business Impact

The ability to include arbitrary local files poses a severe risk to the confidentiality, integrity, and availability of the entire web server. Successful exploitation can lead to the exposure of sensitive configuration files, database credentials, or remote code execution, which may result in full system compromise and significant reputational damage. With a CVSS score of 8.1, this high-severity flaw requires immediate attention to prevent unauthorized access to the underlying infrastructure.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Rhythmo theme or switch to an alternative theme until a vendor-supplied update is verified.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) payloads and directory traversal attempts directed at the WordPress environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant given the lack of authentication required to trigger the vulnerable code path.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion, this vulnerability presents a significant risk to any site running the Rhythmo theme. Administrators must prioritize the removal or containment of the affected software immediately. We recommend transitioning to a secure theme version as soon as the vendor releases a fix and verifying that all other WordPress components are up to date to minimize the overall attack surface.

Description Summary:
ThemeREX Bassein contains a local file inclusion vulnerability due to improper control of filenames in include or require statements, potentially allowing unauthorized file access.

Executive Summary:
The ThemeREX Bassein theme is vulnerable to local file inclusion, which could allow an unauthenticated attacker to access or execute sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-28067

Affected Software: ThemeREX Bassein

Affected Versions: 0 through 1.0.15

Vulnerability: The vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can manipulate input parameters to include arbitrary local files, leading to potential information disclosure or remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive files on the host server, which may include configuration files, database credentials, or application source code. Given the CVSS score of 8.1, this flaw poses a high risk to data confidentiality and system integrity, potentially leading to a full compromise of the WordPress environment.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should monitor the vendor website for security updates and apply them immediately upon release. If an update is not yet available, consider disabling the Bassein theme until a fix is provided.

Proactive Monitoring: Review web server access logs for suspicious patterns involving directory traversal characters or unexpected file path inclusions. Monitor for unauthorized access attempts directed at sensitive system configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal or file inclusion attempts. Ensure the web server process runs with the least privilege necessary to limit the impact of potential file access.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on the specific implementation of the include statements within the theme.

Analyst Recommendation

This vulnerability represents a significant security risk to any site utilizing the Bassein theme. Organizations should prioritize patching as soon as the vendor releases a secure version and maintain strict monitoring of the affected environment until remediation is confirmed.

Description Summary:
The ThemeREX Legrand WordPress theme contains a local file inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Legrand theme for WordPress could allow unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28066

Affected Software: ThemeREX Legrand

Affected Versions: 0 through 2.17

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98. The software fails to properly sanitize user-supplied input used in PHP include or require statements, allowing an unauthenticated attacker to include unauthorized files from the local filesystem.

Business Impact

The CVSS score of 8.1 indicates a high risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to full server compromise, unauthorized access to sensitive configuration files or credentials, and potential remote code execution, posing a significant threat to organizational data security.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should verify if the theme developer has released an update and apply it immediately. If no update is available, consider switching to a different theme or disabling the Legrand theme until a vendor-supplied fix is provided.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or references to sensitive files like etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests directed at the theme directory.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the nature of the flaw makes it highly susceptible to weaponization if the vulnerable endpoint is exposed to the internet.

Analyst Recommendation

Given the high CVSS score and the critical nature of local file inclusion flaws, organizations should prioritize auditing their WordPress installations for the presence of the Legrand theme. If identified, treat the system as high risk and implement strict access controls and WAF protections until a formal vendor patch is confirmed and applied.

Description Summary:
ThemeREX Eject is susceptible to a Local File Inclusion vulnerability due to improper control of filenames in include statements, potentially allowing unauthorized file access.

Executive Summary:
A critical Local File Inclusion vulnerability in the ThemeREX Eject theme allows unauthenticated attackers to potentially read sensitive system files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28065

Affected Software: ThemeREX Eject

Affected Versions: 0 through 2.17

Vulnerability: This vulnerability, classified as CWE-98, occurs because the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can manipulate this input to include local files, leading to information disclosure or potential remote code execution.

Business Impact

The ability to include arbitrary local files poses a significant risk to data confidentiality and system integrity. Successful exploitation could allow an attacker to read configuration files containing database credentials or sensitive environment variables, ultimately leading to full site compromise. With a CVSS score of 8.1, this high-severity flaw requires urgent attention to prevent unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately disable or remove the Eject theme if it is not essential to business operations.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns, such as sequences like "../" or null byte injections, directed at the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule specifically configured to block directory traversal attempts and restrict access to sensitive system files from the web server context.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, the lack of an available fix requires immediate manual intervention to reduce the attack surface.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue presents a substantial risk to any WordPress environment utilizing the Eject theme. Security teams must prioritize the deactivation of the affected component until a vendor-supplied update is verified and applied. Continuous monitoring of server integrity is advised until the environment is fully remediated.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Edge Decor WordPress theme allows unauthenticated attackers to manipulate file paths and potentially access sensitive server files.

Executive Summary:
The ThemeREX Edge Decor theme for WordPress contains a critical local file inclusion vulnerability that could allow an unauthenticated attacker to compromise server-side data.

Vulnerability Details

CVE-ID: CVE-2026-28064

Affected Software: ThemeREX Edge Decor

Affected Versions: 0 through 2.2

Vulnerability: This vulnerability is a local file inclusion flaw caused by improper control of filenames in PHP include or require statements. An unauthenticated attacker can exploit this to read arbitrary files from the server, potentially leading to full system compromise depending on the server configuration.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the hosting environment. By accessing sensitive configuration files or source code, an attacker could gain further unauthorized access to the application or database, resulting in data breaches and potential service disruption. With a CVSS score of 8.1, this flaw represents a high risk that requires immediate attention to prevent unauthorized system access.

Remediation Plan

Immediate Action: Since no specific patch version is currently listed, administrators should immediately deactivate the Edge Decor theme until a security update is released by the vendor.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward theme-related files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the nature of the flaw makes it highly attractive for reconnaissance and initial access.

Analyst Recommendation

Given the severity of this vulnerability and the potential for total impact, organizations currently utilizing the Edge Decor theme must treat this as a high-priority incident. Deactivation of the theme is the safest course of action until the vendor provides a verified security update, as manual remediation of theme source code is prone to error and may be reverted by future updates.

Description Summary:
The ThemeREX Asia Garden WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeREX Asia Garden theme could allow an unauthenticated attacker to access sensitive local files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28063

Affected Software: ThemeREX Asia Garden

Affected Versions: 0 through 1.3.1

Vulnerability: The flaw is categorized as CWE-98, involving improper control of filenames used in include or require statements. An unauthenticated attacker can leverage this weakness to perform Local File Inclusion, potentially accessing unauthorized files on the server.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to data confidentiality and integrity. An attacker could read sensitive configuration files, including database credentials, or potentially achieve remote code execution, leading to full site compromise and severe reputational damage. The CVSS score of 8.1 reflects the high potential for total system impact and unauthorized data access.

Remediation Plan

Immediate Action: Since a specific patched version is not yet confirmed, administrators should immediately deactivate or remove the Asia Garden theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as directory traversal sequences or attempts to include unexpected local files via URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and directory traversal attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited, Local File Inclusion flaws are inherently dangerous and should be addressed as a high priority to prevent future unauthorized access.

Analyst Recommendation

Given the high impact of this vulnerability, immediate defensive action is required. Organizations using the ThemeREX Asia Garden theme must monitor the vendor's security disclosures for a patch release and apply it without delay. Until such a fix is verified, removing the theme is the most effective way to eliminate the risk of exploitation.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Happy Baby theme allows unauthenticated attackers to include arbitrary files via improper filename control in PHP include statements.

Executive Summary:
The ThemeREX Happy Baby theme contains a critical Local File Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary code or access sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-28062

Affected Software: ThemeREX Happy Baby

Affected Versions: 0 through 1.2.12

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw occurring within the theme's PHP include/require logic. It allows an unauthenticated attacker to manipulate file paths, potentially resulting in unauthorized file access or remote code execution.

Business Impact

The CVSS score of 8.1 indicates a high severity risk that could lead to full system compromise. Successful exploitation allows an attacker to read sensitive configuration files or execute arbitrary scripts, leading to complete data exfiltration and potential loss of control over the WordPress installation.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately disable or uninstall the Happy Baby theme until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious PHP include parameters.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication required to trigger the file inclusion mechanism.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue represents a significant threat to server integrity. We strongly recommend removing the affected theme from production environments immediately and replacing it with a secure alternative, as no vendor-provided patch has been verified at this time.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Tiger Claw theme allows unauthenticated attackers to include arbitrary files, potentially leading to full system compromise.

Executive Summary:
The ThemeREX Tiger Claw theme is vulnerable to Local File Inclusion, which permits unauthenticated attackers to access sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28061

Affected Software: ThemeREX Tiger Claw

Affected Versions: 0 through 1.1.14

Vulnerability: This flaw is a Local File Inclusion (CWE-98) occurring due to improper control of filenames used in include or require statements. The vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

This vulnerability carries a CVSS score of 8.1, indicating a high level of severity due to the potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read sensitive configuration files, steal database credentials, or achieve remote code execution, resulting in significant data breaches and prolonged service outages.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, administrators should immediately deactivate or uninstall the Tiger Claw theme if it is not essential to business operations.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal patterns, such as sequences of dots and slashes, directed at the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters or unexpected file inclusion attempts targeting the theme path.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is high, the attack complexity is noted as high, which may hinder immediate automated exploitation.

Analyst Recommendation

Given the potential for complete system compromise, this vulnerability poses a severe risk to any WordPress environment utilizing the Tiger Claw theme. Organizations are urged to prioritize the removal or replacement of this theme immediately, as no official patch is currently confirmed. Maintain heightened vigilance until the vendor releases a secure update and it is verified in your environment.

Description Summary:
A local file inclusion vulnerability in the ThemeREX S.King theme allows unauthenticated attackers to manipulate include or require statements in PHP files.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX S.King theme exposes systems to unauthorized file access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-28060

Affected Software: ThemeREX S.King

Affected Versions: 0 through 1.5.3

Vulnerability: This is a local file inclusion (LFI) flaw, categorized as CWE-98, arising from improper control of filenames used in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform local file inclusion allows an attacker to read sensitive server files, including configuration files or credentials, and potentially execute arbitrary code on the underlying server. Given the CVSS score of 8.1, this represents a high risk that could lead to full system compromise, significant data exfiltration, and severe reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the S.King theme if it is not business-critical. If the theme must remain active, ensure that all directory permissions are restricted and the web server is configured to prevent directory traversal.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule designed to detect and block common file inclusion payload patterns and unauthorized attempts to access sensitive system files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit provides a temporary buffer, the nature of the flaw makes it a high-value target for automated scanning and manual exploitation.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators must prioritize the containment of this threat by restricting access to the vulnerable theme or implementing robust perimeter filtering until a formal security update is provided by the vendor.

Description Summary:
A Local File Inclusion vulnerability in the ThemeREX Dermatology Clinic WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
The ThemeREX Dermatology Clinic theme contains a Local File Inclusion vulnerability that could allow an unauthenticated attacker to compromise system files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28059

Affected Software: ThemeREX Dermatology Clinic

Affected Versions: 0 through 1.4.3

Vulnerability: This flaw, categorized as CWE-98, involves the improper control of filenames for include or require statements in PHP code, allowing an unauthenticated attacker to perform Local File Inclusion.

Business Impact

A successful exploit poses a significant risk to the integrity and confidentiality of the host environment. By including local files, an attacker may be able to read sensitive system configuration files or potentially achieve remote code execution, leading to a complete system compromise. With a CVSS score of 8.1, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to backend infrastructure.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Dermatology Clinic theme until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and directory traversal attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: No — exploit_available (unknown).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically accessible to unauthenticated users, the high complexity requirement noted in the CVSS vector suggests that exploitation may require specific environmental conditions.

Analyst Recommendation

Given the potential for full system compromise, this vulnerability represents a significant risk to WordPress installations utilizing the Dermatology Clinic theme. Organizations must prioritize the deactivation of this component until the vendor provides a verified fix. Continuous monitoring of server logs is essential to detect any attempts to leverage this flaw while awaiting remediation.

Description Summary:
The ThemeREX Dixon WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeREX Dixon theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28058

Affected Software: ThemeREX Dixon

Affected Versions: 0 through 1.4.2.1

Vulnerability: This vulnerability is a Local File Inclusion flaw (CWE-98) occurring within the theme's PHP file handling logic. An unauthenticated attacker can exploit this flaw to include unauthorized files, leading to sensitive data exposure or potential remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for complete system compromise. Organizations utilizing the affected theme may face significant data breaches, loss of administrative control, and prolonged service disruption.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for any available theme updates, and if no patch is currently provided, consider deactivating or removing the Dixon theme until a secure version is released.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and malicious file inclusion requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the technical nature of Local File Inclusion vulnerabilities makes them highly dangerous if discovered by threat actors.

Analyst Recommendation

Given the High severity of this vulnerability and the potential for full system compromise, administrators must prioritize the security of their WordPress installations. If a vendor update is not yet available, immediate deactivation of the Dixon theme is the most effective way to eliminate the attack surface. Monitor vendor channels closely for the release of a patched version.

Description Summary:
The ThemeREX Mandala theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate file paths in include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Mandala WordPress theme exposes systems to unauthorized file access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-28057

Affected Software: ThemeREX Mandala

Affected Versions: 0 through 2.8

Vulnerability: This vulnerability is a local file inclusion flaw caused by improper control of filenames in PHP include statements. An unauthenticated attacker can exploit this via the network to read sensitive files or execute arbitrary code on the hosting server.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the web application, including unauthorized access to sensitive configuration files, database credentials, and source code. With a CVSS score of 8.1, the risk is high as it permits an unauthenticated actor to gain significant control over the server environment. This poses a severe threat to data confidentiality, integrity, and overall system availability.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or remove the Mandala theme until an official security update is released by ThemeREX.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing path traversal sequences or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for remote code execution, making it a priority for administrative action once a patch becomes available.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must treat this as a critical security risk. We recommend immediate deactivation of the affected theme to prevent potential exploitation while awaiting a vendor-provided fix. Continuous monitoring of the environment is essential until the software is updated or replaced.

Description Summary:
The ThemeREX MCKinney's Politics WordPress theme contains a local file inclusion vulnerability via improper control of filenames in include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX MCKinney's Politics theme poses a significant risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-28056

Affected Software: ThemeREX MCKinney's Politics

Affected Versions: 0 through 1.2.8

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw resulting from improper control of filenames used in include or require statements. An unauthenticated attacker can exploit this weakness to access sensitive files on the server.

Business Impact

Successful exploitation allows an attacker to read arbitrary files from the server, which may include configuration files, credentials, or sensitive application code. Given the CVSS score of 8.1, this vulnerability poses a high risk to data confidentiality and integrity, potentially leading to a full system compromise and significant reputational damage.

Remediation Plan

Immediate Action: Since no patch is explicitly confirmed, users should immediately deactivate or remove the MCKinney's Politics theme until a security update is released by ThemeREX.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious path traversal patterns, such as sequences like "../" or attempts to access common system files like /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI payloads and directory traversal attempts targeting WordPress theme directories.

Exploitation Status

Public Exploit Available: No (Exploit available: false)

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires specific conditions to trigger, the ability for an unauthenticated attacker to read local files makes this a high-priority concern for any environment running this theme.

Analyst Recommendation

Given the potential for unauthorized data disclosure and the high severity of the vulnerability, administrators must prioritize the removal of the vulnerable theme. Organizations should perform a thorough audit of all active WordPress themes and implement strict file permission policies to limit the potential impact of file inclusion vulnerabilities.

Description Summary:
The ThemeREX Legal Stone WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Legal Stone theme for WordPress allows unauthenticated attackers to potentially read sensitive files or execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-28054

Affected Software: ThemeREX Legal Stone

Affected Versions: 0 through 1.2.11

Vulnerability: The flaw is categorized as a local file inclusion (CWE-98) issue, where the application fails to properly sanitize user-supplied input used in include statements. An unauthenticated attacker can leverage this weakness to include malicious files from the server, leading to full compromise of the application.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for an attacker to gain unauthorized access to sensitive configuration files, database credentials, or execute arbitrary code on the underlying server. Such a breach could result in total system compromise and severe reputational damage.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed as available, administrators should immediately deactivate or uninstall the Legal Stone theme if it is not strictly necessary for business operations. If the theme must remain active, ensure strict access controls are in place and monitor the environment for suspicious file access patterns.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward the theme's directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and directory traversal attempts targeting the WordPress installation.

Exploitation Status

Public Exploit Available: No — exploit_available (unknown).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on the specific implementation of the theme's file inclusion logic.

Analyst Recommendation

Given the critical nature of local file inclusion vulnerabilities, administrators must treat this threat with high urgency. If an update becomes available, it should be applied immediately to neutralize the risk of unauthorized file access and potential remote code execution. In the interim, isolating the affected system or removing the vulnerable theme is the most effective way to secure your infrastructure against this threat.

Description Summary:
The ThemeREX Miller WordPress theme contains a local file inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability exists in the ThemeREX Miller WordPress theme that could allow an unauthenticated attacker to access sensitive local files.

Vulnerability Details

CVE-ID: CVE-2026-28053

Affected Software: ThemeREX Miller

Affected Versions: 0 through 1.3.3

Vulnerability: This vulnerability involves improper control of filenames for include or require statements, categorized as CWE-98. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized data exposure or system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a significant risk to the confidentiality, integrity, and availability of the host environment. Successful exploitation could allow unauthorized parties to read sensitive configuration files or execute arbitrary code on the web server, leading to full site compromise and potential data breaches.

Remediation Plan

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should immediately deactivate the Miller theme or restrict access to the affected site until a fix is released by ThemeREX.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) attack vectors and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires careful handling as it allows for remote interaction without authentication, though the high attack complexity noted in the CVSS vector suggests specific conditions may be required for a successful exploit.

Analyst Recommendation

Given the severity of this vulnerability, organizations currently using the ThemeREX Miller theme should prioritize its immediate removal or isolation from the public network. Organizations must remain vigilant for vendor-provided security updates and apply them as soon as they become available to restore secure functionality.

Description Summary:
A local file inclusion vulnerability in the ThemeREX Peter Mason WordPress theme allows unauthenticated attackers to include arbitrary local files.

Executive Summary:
The Peter Mason theme for WordPress contains a critical file inclusion vulnerability that allows unauthenticated attackers to access sensitive local system files.

Vulnerability Details

CVE-ID: CVE-2026-28052

Affected Software: ThemeREX Peter Mason

Affected Versions: 0 through 1.4.5

Vulnerability: This vulnerability, categorized as CWE-98, stems from improper control of filenames used in include or require statements. An unauthenticated attacker can manipulate these inputs to perform local file inclusion, potentially leading to unauthorized data disclosure or code execution.

Business Impact

The ability for an unauthenticated user to perform local file inclusion poses a severe risk to the confidentiality and integrity of the hosting environment. Successful exploitation could allow an attacker to read sensitive configuration files or credentials, leading to full system compromise. With a CVSS score of 8.1, this high severity flaw warrants immediate attention to prevent unauthorized access to the underlying server infrastructure.

Remediation Plan

Immediate Action: Administrators should immediately deactivate the Peter Mason theme until a security update is released by ThemeREX. If an update becomes available, apply the patch immediately to resolve the vulnerable file inclusion path.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns or unusual file inclusion attempts. Monitor for anomalous traffic directed at PHP files within the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and malicious file inclusion attempts. Ensure the web server process runs with the least privilege necessary to limit the impact of potential file access.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently weaponized, the nature of local file inclusion vulnerabilities makes them highly desirable targets for attackers looking to escalate privileges or exfiltrate sensitive data.

Analyst Recommendation

Given the high CVSS score and the potential for total system impact, this vulnerability represents a significant security risk. Administrators are urged to prioritize the removal or patching of the affected theme. Until a verified patch is provided by the vendor, deactivation is the only reliable method to eliminate the risk of exploitation.

Description Summary:
ThemeREX Yacht Rental WordPress theme is vulnerable to Local File Inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A critical Local File Inclusion vulnerability in the ThemeREX Yacht Rental theme allows unauthenticated attackers to potentially read sensitive system files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28051

Affected Software: ThemeREX Yacht Rental

Affected Versions: 0 through 2.6

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98. An unauthenticated attacker can manipulate input parameters to include unauthorized local files, which may lead to information disclosure or remote code execution depending on the server configuration.

Business Impact

Successful exploitation of this flaw could result in the unauthorized disclosure of sensitive server-side files, configuration data, or credentials. Given the CVSS score of 8.1, the risk of total system impact is high, potentially leading to a complete compromise of the WordPress installation and its underlying host environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Patchstack vulnerability database and the ThemeREX website for security updates, or consider switching to a different theme if an update is not provided promptly.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as "../", or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common directory traversal patterns and unauthorized file inclusion attempts targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on specific server configurations and the presence of accessible local files.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, as LFI flaws provide a direct pathway for full system compromise. Administrators must prioritize updating the Yacht Rental theme as soon as a fix is released or implement stringent access controls and WAF rules to mitigate the risk of exploitation.

Description Summary:
The ThemeREX Police Department WordPress theme is vulnerable to local file inclusion due to improper validation of filenames used in include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Police Department theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28049

Affected Software: ThemeREX Police Department

Affected Versions: 0 through 2.17

Vulnerability: This is a local file inclusion (LFI) vulnerability (CWE-98) occurring within the theme's handling of include statements. An unauthenticated attacker can leverage this flaw to include unauthorized files, leading to sensitive data exposure or potential remote code execution.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational data integrity and server availability. With a CVSS score of 8.1, the high impact on confidentiality, integrity, and availability means an attacker could compromise the entire web application, steal database credentials, or gain a foothold within the hosting environment.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable or remove the ThemeREX Police Department theme until a security update is released by the vendor.

Proactive Monitoring: Review web server error and access logs for requests containing suspicious path traversal patterns or unexpected file inclusions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences or attempts to access restricted PHP files.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of an available patch complicates remediation, the nature of LFI flaws makes them a primary target for automated scanning tools.

Analyst Recommendation

Given the high CVSS score and the potential for total system compromise, this vulnerability requires immediate attention. Security teams should prioritize the removal of the vulnerable theme from all production environments until the vendor provides a verified fix, as LFI vulnerabilities are frequently weaponized once technical details become public.

Description Summary:
The ThemeREX N7 Golf Club Sports and Events WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeREX N7 WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28045

Affected Software: ThemeREX N7 | Golf Club Sports & Events

Affected Versions: 0 through 2.16.0

Vulnerability: This vulnerability is a Local File Inclusion flaw (CWE-98) occurring within the theme's PHP file handling logic. An unauthenticated attacker can supply malicious input to trigger the inclusion of local files, resulting in unauthorized file access or potential remote code execution.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress site. With a CVSS score of 8.1, the flaw allows an attacker to bypass access controls to view sensitive configuration files or execute malicious payloads, which can lead to complete site compromise, data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Since no specific patch is confirmed, administrators should immediately deactivate the N7 | Golf Club Sports & Events theme until a security update is released by ThemeREX. If the theme is required for business operations, verify if the vendor has provided a temporary patch or updated version via their official support channels.

Proactive Monitoring: Review server access logs for suspicious requests containing directory traversal patterns or unexpected file path inclusions. Monitor for unauthorized file modifications or the creation of new, unknown files within the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal sequences and malicious file inclusion attempts. This can provide a critical layer of defense while awaiting a formal vendor patch.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is severe due to the lack of required authentication, making it a high priority for remediation once a fix becomes available.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue represents a critical risk to any site using the N7 theme. Security teams must prioritize deactivating the vulnerable component until a vendor-supplied update is verified and applied. Continuous monitoring of web application logs is essential to detect any attempts to exploit this flaw while no patch is present.

Description Summary:
The ThemeREX Gridiron WordPress theme is vulnerable to local file inclusion due to improper filename control in include statements, potentially allowing unauthorized access to sensitive files.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeREX Gridiron theme allows unauthenticated attackers to potentially read sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-28012

Affected Software: ThemeREX Gridiron

Affected Versions: 0 through 1.0.14

Vulnerability: This is a local file inclusion (CWE-98) vulnerability occurring within the theme's PHP file handling logic. The vulnerability is accessible to unauthenticated attackers via network vectors, as indicated by the CVSS vector AV:N/PR:N.

Business Impact

The ability to perform local file inclusion can lead to the unauthorized disclosure of sensitive server-side files, including configuration files, credentials, or source code. Given the CVSS score of 8.1, this vulnerability poses a high risk of total impact to confidentiality, integrity, and availability, which could result in full system compromise or significant data breach.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the Gridiron theme until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or attempts to include unexpected PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion and directory traversal attack payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable due to the lack of authentication requirements, current data does not confirm the existence of a weaponized exploit.

Analyst Recommendation

Given the high severity of this file inclusion vulnerability, organizations utilizing the ThemeREX Gridiron theme should treat this as a priority. Immediate mitigation through deactivation is necessary to prevent potential unauthorized access to the underlying server environment until the vendor provides a verified security update.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the ThemeREX Scientia theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
A critical Local File Inclusion vulnerability in the ThemeREX Scientia theme permits unauthenticated attackers to manipulate file paths, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-28010

Affected Software: ThemeREX Scientia

Affected Versions: 0 through 1.2.4

Vulnerability: This flaw is classified as a CWE-98 vulnerability, where improper control of filename inputs in include or require statements allows an unauthenticated attacker to perform Local File Inclusion. By manipulating the input, an attacker can force the application to execute or disclose sensitive files located on the server.

Business Impact

The ability to include local files can lead to the exposure of sensitive configuration files, source code, or credentials, and may allow an attacker to achieve remote code execution. Given the CVSS score of 8.1, this vulnerability poses a high risk to the confidentiality, integrity, and availability of the hosting environment. Successful exploitation could result in total system compromise and significant data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the ThemeREX Scientia theme if it is not mission critical. Contact the vendor or monitor the official Patchstack advisory page for the release of a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns, such as sequences like dot dot slash, directed toward the theme directory. Monitor for unauthorized file access attempts or unexpected outbound network connections from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to block directory traversal and local file inclusion attempts. Ensure the web server process is running with the least privilege necessary to restrict the impact of potential file access.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, it requires specific conditions to trigger, and current data does not indicate that weaponized exploits are circulating.

Analyst Recommendation

The risk associated with this LFI vulnerability is significant due to the potential for complete system compromise. Organizations utilizing the Scientia theme must prioritize the removal or containment of the affected software until a verified vendor patch is applied. Immediate action is required to reduce the attack surface and prevent unauthorized access.

Description Summary:
ThemeREX Coinpress is susceptible to a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements within the PHP application.

Executive Summary:
A Local File Inclusion vulnerability in the ThemeREX Coinpress WordPress theme allows unauthenticated attackers to read sensitive files or potentially execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28007

Affected Software: ThemeREX Coinpress

Affected Versions: 0 through 1.0.14

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw where an unauthenticated attacker can manipulate the file path input to include unintended local files, leading to sensitive data exposure or potential remote code execution.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive configuration files or execute malicious PHP code, resulting in total system compromise. Given the CVSS score of 8.1, this is a high severity issue that carries significant risk of data exfiltration and unauthorized administrative access to the underlying WordPress environment.

Remediation Plan

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately deactivate the Coinpress theme if not strictly required, or implement strict file system permissions to limit the web server's ability to access sensitive files.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common file inclusion payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dangerous because it facilitates unauthenticated access to the server file system.

Analyst Recommendation

Given the potential for complete system compromise, organizations currently utilizing the Coinpress theme must prioritize immediate risk mitigation. Ensure the theme is updated if a vendor release becomes available, and maintain a posture of least privilege for the web server user account to contain the impact of any potential exploitation.

Description Summary:
A local file inclusion vulnerability in the ThemeREX ProLingua theme allows an unauthenticated attacker to include unauthorized files via improper control of filename inputs.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX ProLingua theme exposes the underlying server to potential unauthorized file access and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-22504

Affected Software: ThemeREX ProLingua

Affected Versions: 0 through 1.1.12

Vulnerability: This vulnerability is a local file inclusion (CWE-98) flaw occurring within the theme's PHP include statements. An unauthenticated attacker can manipulate input parameters to include arbitrary local files on the server.

Business Impact

The ability to include local files can lead to the exposure of sensitive configuration files, system credentials, or the execution of arbitrary PHP code if an attacker can upload malicious files or leverage existing logs. Given the high CVSS score of 8.1, this represents a significant risk to data confidentiality and system integrity, potentially leading to a complete compromise of the WordPress installation.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should immediately deactivate or remove the ProLingua theme if it is not strictly required for site operations.

Proactive Monitoring: Monitor web server access logs for requests containing path traversal patterns, such as sequences of dots and slashes, or requests directed at sensitive system files like /etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and unauthorized attempts to access sensitive PHP files.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for specific environmental conditions makes it somewhat complex to exploit, but the potential impact remains severe.

Analyst Recommendation

This vulnerability presents a serious risk of unauthorized system access. Administrators should prioritize the removal of the vulnerable theme or transition to a secure alternative until the vendor releases a verified patch. Monitoring for suspicious traffic directed at theme file paths is essential to detect potential exploitation attempts.

Description Summary:
The ThemeREX Nelson theme is susceptible to a local file inclusion vulnerability due to improper filename control in include statements, potentially allowing unauthorized file access.

Executive Summary:
The ThemeREX Nelson WordPress theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to access sensitive files on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22503

Affected Software: ThemeREX Nelson

Affected Versions: 0 through 1.2.0

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw stemming from CWE-98, where input used in PHP include or require statements is not properly sanitized. An unauthenticated attacker can leverage this to include arbitrary local files, potentially leading to unauthorized data disclosure or code execution.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation could allow an attacker to read sensitive configuration files, credentials, or source code, which may lead to a full system compromise, loss of data integrity, and significant reputational damage.

Remediation Plan

Immediate Action: Check the official ThemeREX or Patchstack advisory for the latest security update and apply it immediately to address the inclusion flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access restricted PHP files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns or unexpected file paths targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk is high, the requirement for specific environmental conditions or file paths often limits the ease of exploitation.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise, administrators should prioritize this update. If a patch is not yet available from the vendor, consider disabling the Nelson theme until a secure version is released to prevent potential exploitation of this critical flaw.

Description Summary:
The ThemeREX Good Homes WordPress theme is susceptible to a Local File Inclusion (LFI) vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
The ThemeREX Good Homes theme contains a critical Local File Inclusion vulnerability that could allow an unauthenticated attacker to access or execute arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2026-22494

Affected Software: ThemeREX Good Homes

Affected Versions: 0 through 1.3.13

Vulnerability: This vulnerability, categorized as CWE-98, stems from the improper handling of user-supplied input in include or require statements. An unauthenticated attacker can manipulate the filename parameter to perform Local File Inclusion, potentially leading to unauthorized data exposure or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment. With a CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for full system compromise. Unauthorized access to sensitive configuration files, source code, or internal data could result in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Good Homes theme if it is not business-critical. If the theme is required, restrict access to the affected site and monitor vendor channels for the release of a security update.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion patterns targeting PHP include functions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score and the nature of LFI flaws necessitate proactive defensive measures, as these vulnerabilities are frequently targeted once technical details become widely known.

Analyst Recommendation

Given the potential for total system impact, this vulnerability must be treated with high urgency. Administrators are advised to prioritize the removal or containment of the affected theme until a vendor-supplied update is confirmed and verified. Failure to address this flaw could lead to complete server compromise by unauthenticated remote actors.

Description Summary:
The ThemeREX Melania WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeREX Melania WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-22324

Affected Software: ThemeREX Melania

Affected Versions: n/a through 2.5.0

Vulnerability: This vulnerability, classified as CWE-98, occurs due to insufficient validation of user-supplied input used in PHP include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized access to system files.

Business Impact

Successful exploitation of this vulnerability allows an attacker to access sensitive information or potentially achieve remote code execution on the underlying server. Given the CVSS score of 8.1, this flaw presents a significant risk to the confidentiality, integrity, and availability of the affected WordPress environment. Organizations using this theme face potential data breaches and total loss of control over the compromised web application.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Melania theme or switch to an alternative theme until a security update is released by ThemeREX.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests containing unusual file paths and PHP extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and restrict access to sensitive system files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for full system compromise, though the high attack complexity noted in the CVSS vector suggests that successful exploitation requires specific environmental conditions.

Analyst Recommendation

The vulnerability in the Melania theme poses a severe security risk that necessitates immediate attention. Until a vendor-supplied patch is confirmed and applied, administrators must prioritize removing the vulnerable component from the production environment to prevent unauthorized access and potential system compromise.

Description Summary:
The ThemeREX Hope WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access.

Executive Summary:
The ThemeREX Hope WordPress theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2025-69081

Affected Software: ThemeREX Hope

Affected Versions: 0 through 3.0.0

Vulnerability: This vulnerability is a local file inclusion (CWE-98) flaw occurring within the theme's PHP include/require logic. It allows an unauthenticated attacker to manipulate input parameters to include arbitrary files on the local filesystem.

Business Impact

This vulnerability carries a CVSS score of 8.1, indicating a high level of risk. Successful exploitation could lead to the exposure of configuration files, credentials, or sensitive application code, potentially resulting in full site compromise or further lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately audit the theme's usage and disable the ThemeREX Hope theme until the vendor releases a secure version.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to include common system files like etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of January 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk is high due to the potential for unauthorized file access, no weaponized exploit code has been identified in public repositories.

Analyst Recommendation

Given the severity of potential file inclusion vulnerabilities, organizations currently running the ThemeREX Hope theme should prioritize its removal or replacement until a confirmed fix is provided by the vendor. Ensure that your security team monitors for any signs of unauthorized file access attempts to determine if the site has already been targeted.

Description Summary:
A deserialization of untrusted data vulnerability exists in the ThemeREX Classter WordPress theme, allowing for potential PHP Object Injection.

Executive Summary:
The ThemeREX Classter WordPress theme is vulnerable to PHP Object Injection, which could allow an unauthenticated attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-54001

Affected Software: ThemeREX Classter

Affected Versions: 0 through 2.5

Vulnerability: This is a deserialization of untrusted data (CWE-502) vulnerability. The flaw allows unauthenticated remote attackers to inject malicious serialized PHP objects, potentially leading to remote code execution or other unauthorized actions.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve remote code execution, effectively granting full control over the affected WordPress installation. Given the CVSS score of 9.8, this poses a critical risk to data confidentiality, integrity, and availability, potentially leading to site defacement, data theft, or the propagation of further malware within the network.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and remove the Classter theme from the WordPress environment until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious serialized strings or unusual activity originating from unknown IP addresses targeting the theme's directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious serialized payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw is inherently dangerous due to the ease of exploitation via public network access.

Analyst Recommendation

The critical nature of this vulnerability necessitates immediate action. Because no patch exists, the only effective mitigation is to discontinue the use of the affected theme. Security teams should prioritize identifying all instances of this software and removing it to prevent potential compromise.

Description Summary:
The ThemeREX Education Center WordPress theme is vulnerable to unauthenticated PHP Object Injection via the themerex_callback_view_more_posts function in versions up to and including 3.6.10.

Executive Summary:
The ThemeREX Education Center WordPress theme contains an unauthenticated PHP Object Injection vulnerability that could lead to remote code execution if a compatible POP chain is present.

Vulnerability Details

CVE-ID: CVE-2024-13786

Affected Software: ThemeREX Education Center | LMS & Online Courses WordPress Theme

Affected Versions: 0 through 3.6.10

Vulnerability: This vulnerability involves the deserialization of untrusted input within the themerex_callback_view_more_posts function, allowing unauthenticated attackers to inject malicious PHP objects. While the theme itself does not contain a Property Oriented Programming (POP) chain, the presence of other vulnerable plugins or themes on the same installation may facilitate arbitrary file deletion, sensitive data exposure, or remote code execution.

Business Impact

The exploitation of this vulnerability poses a critical risk to site integrity and data confidentiality, as indicated by the CVSS score of 9.8. Successful exploitation could result in full site compromise, unauthorized access to sensitive student or course data, and potential server-side code execution, leading to significant reputational damage and operational downtime.

Remediation Plan

Immediate Action: Review the ThemeREX changelog and update the Education Center theme to the latest available version that addresses this deserialization flaw. If an update is not immediately available, disable the theme or restrict access to the vulnerable functionality until a patch is applied.

Proactive Monitoring: Monitor server access logs for unusual POST requests directed at themes or plugins, specifically looking for serialized data structures in input parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and suspicious serialized strings in HTTP requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 2, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is strictly dependent on the presence of a secondary component containing a POP chain, which significantly lowers the immediate exploitability in isolated environments.

Analyst Recommendation

Given the high CVSS severity score, administrators should prioritize updating the theme as soon as a vendor patch is released. Even in the absence of a confirmed POP chain within the theme itself, the potential for total system compromise necessitates a proactive patching strategy to eliminate the underlying injection vector.