What is the CVSS score of CVE-2026-28024?

CVE-2026-28024 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Helion WordPress Theme are affected by CVE-2026-28024?

CVE-2026-28024 affects axiomthemes Helion WordPress theme up to version 1.1.12, allowing unauthenticated remote attackers to read arbitrary files on affected servers through improper filename…

How to fix or mitigate CVE-2026-28024?

Within 24 hours: Inventory all WordPress installations using axiomthemes Helion theme and document current versions via admin dashboard or WP-CLI command 'wp theme list'. Within 7 days: Upgrade Helion theme to version 1.1.13 or later if available from axiomthemes, or disable and replace with alternative theme pending vendor patch release; review web server access logs for suspicious file access patterns (../config, wp-config, .env requests). Within 30 days: Conduct file integrity audit of wp-config.php and other sensitive configuration files; implement Web Application Firewall rules to block directory traversal patterns in HTTP requests; document compensating controls for any systems unable to patch immediately.

Helion WordPress Theme CVE-2026-28024

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Helion helion allows PHP Local File Inclusion.This issue affects Helion: from n/a through <= 1.1.12.

AnalysisAI

Local file inclusion in axiomthemes Helion WordPress theme through version 1.1.12 enables remote attackers to read arbitrary files and potentially execute malicious code through improper filename validation in PHP include/require statements. While CVSS scores 8.1 (High) with network vector and no authentication required, attack complexity is rated High and EPSS shows only 0.15% exploitation probability (36th percentile), suggesting limited real-world weaponization. The CWE-98 classification indicates classic PHP file inclusion vulnerabilities where attacker-controlled input influences file paths in include() or require() functions. Patchstack database lists this as both LFI and information disclosure, indicating read access is confirmed while remote code execution depends on exploitation chain completeness.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a class of PHP injection flaws where user-supplied input insufficiently sanitized before being passed to include(), require(), include_once(), or require_once() functions. The Helion theme (a commercial WordPress theme by axiomthemes) fails to validate file paths, allowing attackers to manipulate parameters that control which PHP files are loaded. While the CVE title references 'PHP Remote File Inclusion', Patchstack and the description classify this specifically as Local File Inclusion (LFI), meaning attackers can force the application to include local server files rather than arbitrary remote URLs. This distinction is critical: LFI typically requires chaining with other techniques (log poisoning, PHP wrappers, uploaded files) to achieve code execution, whereas RFI directly loads remote malicious code. The affected component is a WordPress theme, which handles template loading and dynamic content rendering through extensive use of PHP file inclusion for modularity.

Affected ProductsAI

The vulnerability affects axiomthemes Helion WordPress theme from initial release through version 1.1.12 inclusive. Helion is a premium multipurpose WordPress theme marketed for business and creative websites. The vendor is axiomthemes, an Envato/ThemeForest author with multiple commercial WordPress products. All installations running Helion version 1.1.12 or earlier are vulnerable. The CVE description notes the starting version as 'n/a', indicating all historical versions contain the flaw. Specific CPE data is not provided in the intelligence sources. Users can verify their version through WordPress admin dashboard under Appearance > Themes. The Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/helion/vulnerability/wordpress-helion-theme-1-1-12-local-file-inclusion-vulnerability serves as the primary vendor advisory and technical reference.

RemediationAI

Upgrade Helion theme to version 1.1.13 or later if available. Contact axiomthemes directly through ThemeForest or their support channels to obtain the patched version, as the CVE disclosure does not specify an exact fix release. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/helion/vulnerability/wordpress-helion-theme-1-1-12-local-file-inclusion-vulnerability for confirmation of patched version availability. If immediate upgrade is not feasible, implement compensating controls: restrict WordPress administrative access to trusted IP addresses via .htaccess or firewall rules to limit attack surface, deploy a web application firewall with LFI detection rules targeting common path traversal patterns (../, directory separators, PHP wrappers like php://filter), set restrictive file permissions (444 or 440) on sensitive files like wp-config.php to prevent unauthorized reads even if inclusion occurs. Note these workarounds do not eliminate the vulnerability and may interfere with legitimate theme functionality requiring dynamic file loading. Consider switching to an actively maintained alternative theme if axiomthemes does not provide timely security updates, as theme abandonment increases long-term risk. Monitor WordPress and server access logs for suspicious file access patterns (repeated 404s with path traversal characters, unusual file extension requests).