What is the CVSS score of CVE-2026-28021?

CVE-2026-28021 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Craftis WordPress Theme are affected by CVE-2026-28021?

ThemeREX Craftis WordPress theme versions 1.2.8 and earlier contain a local file inclusion vulnerability (CVSS 8.1) that allows remote attackers to read arbitrary server files and potentially execute…

How to fix or mitigate CVE-2026-28021?

Within 24 hours: Identify all WordPress installations using ThemeREX Craftis theme and document current versions via admin dashboard or wp-cli. Within 7 days: If version 1.2.8 or earlier, disable the theme, switch to an alternative theme, and restrict plugin/theme upload capabilities to administrators only. Within 30 days: Monitor Patchstack and ThemeREX official channels for version 1.2.9 release; apply immediately upon availability and conduct file integrity verification on affected servers.

Craftis WordPress Theme CVE-2026-28021

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through <= 1.2.8.

AnalysisAI

Local file inclusion in ThemeREX Craftis WordPress theme versions through 1.2.8 enables remote attackers to read arbitrary server files and potentially achieve remote code execution via PHP file inclusion. The vulnerability stems from improper validation of filenames in include/require statements, allowing traversal to sensitive files. EPSS score of 0.15% indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. Patchstack has documented this vulnerability affecting all installations prior to version 1.2.9.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement) in a WordPress theme. The Craftis theme fails to properly sanitize user-controlled input before passing it to PHP include() or require() functions. While categorized as 'PHP Remote File Inclusion' by the reporter, the actual impact is PHP Local File Inclusion (LFI) as tagged. LFI vulnerabilities allow attackers to force the application to include local files from the server's filesystem through directory traversal sequences (../) or null byte injection. In WordPress themes, this typically occurs in template loading mechanisms or AJAX handlers. Unlike true RFI which requires allow_url_include=On (disabled by default since PHP 5.2), LFI works regardless of PHP configuration. When combined with file upload capabilities or log poisoning, LFI can escalate to remote code execution by including attacker-controlled files containing PHP code.

Affected ProductsAI

ThemeREX Craftis WordPress theme versions from initial release through 1.2.8 are confirmed vulnerable per Patchstack database entry. The vulnerability exists in the theme's core PHP file handling routines. All WordPress installations running affected Craftis versions are at risk regardless of WordPress core version. The CPE would be cpe:2.3:a:themerex:craftis:*:*:*:*:*:wordpress:*:* for versions <=1.2.8. Vendor advisory and technical details are available at https://patchstack.com/database/Wordpress/Theme/craftis/vulnerability/wordpress-craftis-theme-1-2-8-local-file-inclusion-vulnerability.

RemediationAI

Update ThemeREX Craftis theme to version 1.2.9 or later which addresses the file inclusion vulnerability according to Patchstack's versioning data (issue affects through 1.2.8, implying 1.2.9+ contains the fix). Download updates through the official ThemeREX channels or WordPress theme update mechanism. If immediate patching is not feasible, implement the following compensating controls: restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to prevent unauthorized theme file uploads that could be leveraged for exploitation; enable a Web Application Firewall (WAF) with rules detecting directory traversal patterns (../, %2e%2e%2f) and PHP file inclusion signatures; disable PHP execution in upload directories by adding 'php_flag engine off' to wp-content/uploads/.htaccess; monitor WordPress access logs for suspicious requests containing traversal sequences or references to sensitive files (/etc/passwd, wp-config.php). Note that WAF rules may generate false positives on legitimate theme functionality and require tuning. Reference the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/craftis/vulnerability/wordpress-craftis-theme-1-2-8-local-file-inclusion-vulnerability for complete technical details.