What is the CVSS score of CVE-2026-28020?

CVE-2026-28020 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Chroma WordPress Theme are affected by CVE-2026-28020?

A local file inclusion vulnerability in ThemeREX Chroma WordPress theme (versions ≤1.11) enables unauthenticated remote attackers to read arbitrary files from affected web servers through improper…

How to fix or mitigate CVE-2026-28020?

Within 24 hours: Identify all WordPress installations using ThemeREX Chroma theme and document current versions. Within 7 days: Disable or remove the vulnerable theme immediately, replacing it with an alternative theme or updating to a patched version once available; monitor Patchstack and vendor advisories daily for patch release. Within 30 days: Conduct file integrity audit on affected servers to detect any unauthorized file access; review web server access logs from deployment date forward for suspicious file inclusion requests (common patterns: /etc/passwd, ../../../).

Chroma WordPress Theme CVE-2026-28020

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:19 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Chroma chroma allows PHP Local File Inclusion.This issue affects Chroma: from n/a through <= 1.11.

AnalysisAI

Local file inclusion vulnerability in ThemeREX Chroma WordPress theme versions ≤1.11 allows remote attackers to read arbitrary files from the web server filesystem through improper filename validation in PHP include/require statements. Despite high CVSS 8.1, EPSS probability is low (0.15%, 36th percentile) and no active exploitation is confirmed. Patchstack has documented this vulnerability, indicating professional security researcher awareness and likely forthcoming vendor response.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The Chroma theme fails to properly sanitize user-supplied input before passing it to PHP include() or require() functions, allowing path traversal sequences (../) or direct file path manipulation. While the description mentions 'PHP Remote File Inclusion' in the vulnerability name, the actual classification and tags confirm this as LFI. WordPress themes commonly exhibit this flaw when dynamically including template files based on GET/POST parameters without allowlist validation or realpath() verification. The vulnerability exists in ThemeREX's Chroma theme through version 1.11, affecting WordPress installations using this premium theme.

Affected ProductsAI

ThemeREX Chroma WordPress theme versions from earliest release through version 1.11 are confirmed vulnerable. This is a premium WordPress theme typically purchased through ThemeForest or directly from ThemeREX. The vulnerability affects all WordPress installations running these theme versions regardless of WordPress core version. For complete vulnerability details and patch information, refer to the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/chroma/vulnerability/wordpress-chroma-theme-1-11-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Chroma theme to version 1.12 or later if available (verify current patched version at ThemeREX official site or Patchstack advisory linked above). If immediate patching is not possible, implement these compensating controls with noted trade-offs: (1) Disable the Chroma theme and switch to a secure alternative theme - causes complete site appearance change requiring design work. (2) Apply Web Application Firewall rules blocking requests containing path traversal sequences (../, %2e%2e%2f, etc.) to theme directories - may cause false positives if legitimate functionality uses dynamic file paths. (3) Set open_basedir PHP directive to restrict file access to WordPress directories only - prevents reading system files but requires server-level configuration access and may break plugins expecting broader filesystem access. (4) Enable WordPress file modification monitoring to detect unauthorized access to sensitive files like wp-config.php. Consult https://patchstack.com/database/Wordpress/Theme/chroma/vulnerability/wordpress-chroma-theme-1-11-local-file-inclusion-vulnerability for vendor-confirmed remediation steps.