What is the CVSS score of CVE-2026-28019?

CVE-2026-28019 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Manoir Theme are affected by CVE-2026-28019?

The Manoir WordPress theme (version 1.11 and earlier) contains a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated attackers to read arbitrary files from affected servers,…

How to fix or mitigate CVE-2026-28019?

Within 24 hours: Identify all WordPress installations using Manoir theme version 1.11 or earlier and deactivate the theme immediately; switch to an actively maintained alternative theme. Within 7 days: Remove the Manoir theme entirely from all affected systems; audit server logs and file access records for evidence of exploitation. Within 30 days: Implement file inclusion input validation controls at the web application firewall (WAF) level; establish a process for quarterly WordPress theme and plugin security assessments.

Manoir Theme CVE-2026-28019

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:20 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Manoir manoir allows PHP Local File Inclusion.This issue affects Manoir: from n/a through <= 1.11.

AnalysisAI

Local file inclusion in the Manoir WordPress theme version 1.11 and earlier allows remote unauthenticated attackers to read arbitrary files on the server through improper validation of file inclusion parameters. Despite the high CVSS score of 8.1, EPSS data indicates low real-world exploitation probability (0.15%, 36th percentile), suggesting this is likely a targeted risk rather than widespread threat. Patchstack database confirms the vulnerability exists but no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP file inclusion. The Manoir WordPress theme fails to properly sanitize user-controlled input before passing it to PHP include/require statements. While classified as 'PHP Remote File Inclusion' in the description, the tags and Patchstack reference confirm this is actually Local File Inclusion (LFI). In LFI attacks, the vulnerable code allows attackers to reference local server files rather than remote URLs. PHP's include/require functions interpret file paths, and without proper validation of directory traversal sequences or absolute paths, attackers can access sensitive files like wp-config.php, /etc/passwd, or other configuration files containing credentials and system information. WordPress themes are particularly susceptible when they dynamically include template files based on URL parameters or POST data without whitelist validation.

Affected ProductsAI

The vulnerability affects the Manoir WordPress theme by ThemeREX, specifically all versions from the initial release through version 1.11. CPE data is not provided in available sources. According to the Patchstack database reference at https://patchstack.com/database/Wordpress/Theme/manoir/vulnerability/wordpress-manoir-theme-1-11-local-file-inclusion-vulnerability, organizations should verify their installed version through WordPress admin dashboard under Appearance > Themes. The vulnerability exists in the theme's PHP file inclusion logic, making all installations of affected versions potentially exploitable regardless of WordPress core version, though actual exploitation depends on specific theme feature usage and configuration.

RemediationAI

ThemeREX should be contacted immediately for patch availability, as no specific fix version is confirmed in current intelligence sources. Organizations running Manoir theme version 1.11 or earlier should check the official ThemeREX website and WordPress theme repository for updates beyond version 1.11. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/manoir/vulnerability/wordpress-manoir-theme-1-11-local-file-inclusion-vulnerability for vendor response and patch timeline. If no patched version is available, implement compensating controls: restrict access to WordPress admin dashboard using IP whitelisting at web server or WAF level to prevent unauthorized theme exploitation; disable the Manoir theme entirely and switch to a maintained alternative if critical features are not required; deploy web application firewall rules to block requests containing directory traversal sequences (../, ../../, %2e%2e%2f) and common LFI payloads targeting theme directories. Note that WAF rules may cause false positives with legitimate file upload features. Monitor WordPress access logs for suspicious requests to theme files with file path parameters. These mitigations reduce but do not eliminate risk; theme replacement or vendor patch remains the only complete solution.