What is the CVSS score of CVE-2026-28014?

CVE-2026-28014 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-28014?

ThemeREX Translogic versions 1.2.11 and earlier contain a critical file inclusion vulnerability that could allow attackers to access sensitive files or execute malicious code on affected systems.

How to fix or mitigate CVE-2026-28014?

Within 24 hours: Identify all WordPress installations running Translogic and disable the plugin/theme immediately; audit access logs for suspicious file inclusion patterns. Within 7 days: Contact ThemeREX for patch availability and timeline; implement Web Application Firewall rules to block file inclusion attempts; conduct forensic analysis for indicators of compromise. Within 30 days: Apply vendor patch when released; perform full security assessment of affected systems; update incident response procedures for WordPress-specific threats.

PHP CVE-2026-28014

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Translogic translogic allows PHP Local File Inclusion.This issue affects Translogic: from n/a through <= 1.2.11.

AnalysisAI

ThemeREX Translogic through version 1.2.11 contains a local file inclusion vulnerability in PHP that enables attackers to read and potentially execute arbitrary files on affected systems without authentication. The improper handling of file include/require statements allows an attacker to manipulate filename inputs and access sensitive server files. No patch is currently available, and exploitation requires specific conditions (network accessible, no user interaction required).

Technical ContextAI

Classified as CWE-98 (PHP Remote File Inclusion). Affects ThemeREX Translogic translogic. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Translogic translogic allows PHP Local File Inclusion.This issue affects Translogic: from n/a through <= 1.2.11.