What is the CVSS score of CVE-2026-28023?

CVE-2026-28023 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Nuts WordPress Theme are affected by CVE-2026-28023?

The ThemeREX Nuts WordPress theme (versions through 1.10) contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web servers.

How to fix or mitigate CVE-2026-28023?

Within 24 hours: Inventory all WordPress installations and identify those using ThemeREX Nuts theme version 1.10 or earlier. Within 7 days: Contact ThemeREX for security guidance and check their advisory channels for a patched version; disable or replace the theme with an alternative if no patch timeline is provided. Within 30 days: Deploy the patched version once released, or complete migration to a secure alternative theme; implement Web Application Firewall (WAF) rules to block LFI payloads as interim protection.

Nuts WordPress Theme CVE-2026-28023

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nuts nuts allows PHP Local File Inclusion.This issue affects Nuts: from n/a through <= 1.10.

AnalysisAI

Local File Inclusion (LFI) in ThemeREX Nuts WordPress theme versions through 1.10 allows remote attackers to read arbitrary files from the web server filesystem without authentication. While CVSS rates this 8.1 High, EPSS exploitation probability is low (0.15%, 36th percentile), suggesting limited active targeting. No CISA KEV listing or public exploit code identified at time of analysis, indicating this remains a theoretical risk requiring specific attack conditions despite the network-accessible vector.

Technical ContextAI

This vulnerability exploits CWE-98 (PHP Remote File Inclusion) via improper validation of file paths passed to PHP include/require statements. The Nuts WordPress theme by ThemeREX fails to sanitize user-controlled input used in file inclusion operations, allowing attackers to manipulate file paths to traverse directories and include local files. Despite the CWE classification mentioning 'Remote File Inclusion', Patchstack tags confirm this is Local File Inclusion, meaning attackers can read server-local files rather than inject remote code. Common attack vectors include exposing wp-config.php for database credentials, /etc/passwd for user enumeration, or application source code for further vulnerability discovery.

Affected ProductsAI

ThemeREX Nuts WordPress theme versions from earliest release through version 1.10 are vulnerable. The vendor advisory at Patchstack (https://patchstack.com/database/Wordpress/Theme/nuts/vulnerability/wordpress-nuts-theme-1-10-local-file-inclusion-vulnerability) provides authoritative affected version information. All WordPress installations using Nuts theme 1.10 or earlier should be considered at risk.

RemediationAI

Upgrade ThemeREX Nuts WordPress theme to version 1.10.1 or later if available - verify current patched version at the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/nuts/vulnerability/wordpress-nuts-theme-1-10-local-file-inclusion-vulnerability). If no patched version exists, immediately switch to an alternative WordPress theme from a reputable vendor with active security support. As interim mitigation if theme replacement is delayed, implement Web Application Firewall (WAF) rules blocking requests containing path traversal sequences (../, %2e%2e%2f, etc.) to theme endpoints, though this may break legitimate theme functionality requiring file path parameters. Restrict wp-content/themes/nuts/ directory permissions to prevent direct web access where feasible. These compensating controls provide limited protection and should not replace theme upgrade or replacement.