What is the CVSS score of CVE-2026-28025?

CVE-2026-28025 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Stargaze WordPress Theme are affected by CVE-2026-28025?

CVE-2026-28025 is a critical remote file inclusion vulnerability affecting ThemeREX Stargaze WordPress theme through version 1.5 that allows unauthenticated attackers to read arbitrary server files…

How to fix or mitigate CVE-2026-28025?

Within 24 hours: Identify all WordPress installations using ThemeREX Stargaze theme through version 1.5 via inventory audit. Within 7 days: Disable or remove the vulnerable theme; if removal is not feasible, implement Web Application Firewall (WAF) rules to block file inclusion attack patterns and restrict HTTP requests containing path traversal sequences (../, etc.). Within 30 days: Upgrade to ThemeREX Stargaze version 1.6 or later when available, or migrate to a maintained alternative WordPress theme with security patch history.

Stargaze WordPress Theme CVE-2026-28025

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Stargaze stargaze allows PHP Local File Inclusion.This issue affects Stargaze: from n/a through <= 1.5.

AnalysisAI

Local file inclusion in ThemeREX Stargaze WordPress theme versions through 1.5 allows remote unauthenticated attackers to read arbitrary files on the server and potentially execute malicious code. Reported by Patchstack security audit team. EPSS probability of 0.15% suggests low widespread exploitation likelihood, though network-accessible vector and high impact ratings warrant attention for sites using this theme. No active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

This vulnerability affects the ThemeREX Stargaze WordPress theme, a commercial theme product. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP file inclusion. Despite the CVE title mentioning 'PHP Remote File Inclusion', the tags and vulnerability classification indicate this is actually a Local File Inclusion (LFI) vulnerability. LFI occurs when user-controlled input is passed to PHP include/require functions without proper sanitization, allowing attackers to specify arbitrary file paths. The vulnerability exists in how the theme processes file paths in its PHP code, likely in template loading, plugin integration, or asset handling functions common to WordPress themes.

Affected ProductsAI

ThemeREX Stargaze WordPress theme versions from unknown initial release through version 1.5 are confirmed vulnerable. The CPE or specific WordPress version compatibility is not provided in available data. Organizations using this theme should check their installed version via WordPress admin dashboard under Appearance > Themes. The Patchstack vulnerability database entry at the provided reference URL should contain complete affected version information and theme-specific deployment details.

RemediationAI

Upgrade to Stargaze theme version 1.5.1 or later if available from ThemeREX. Consult the Patchstack database reference at https://patchstack.com/database/Wordpress/Theme/stargaze/vulnerability/wordpress-stargaze-theme-1-5-local-file-inclusion-vulnerability for confirmed fix version and vendor advisory. If a patched version is not immediately available, implement these compensating controls: disable the Stargaze theme and switch to a vetted alternative WordPress theme until patches are applied (may require design rework); implement web application firewall rules to block requests containing directory traversal patterns (../, %2e%2e/, etc.) targeting theme directories at /wp-content/themes/stargaze/ (may cause false positives on legitimate admin functions); restrict PHP file access permissions to prevent reading sensitive configuration files like wp-config.php (verify application functionality after changes). Contact ThemeREX support directly for emergency patches or migration guidance.