What is the CVSS score of CVE-2026-28026?

CVE-2026-28026 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Motorix Theme are affected by CVE-2026-28026?

The Motorix WordPress theme versions 1.6 and earlier contains a local file inclusion vulnerability (CVSS 8.1) that allows remote attackers to execute arbitrary PHP code and compromise the web server.

How to fix or mitigate CVE-2026-28026?

Within 24 hours: Identify all WordPress installations using Motorix theme version 1.6 or earlier via admin dashboard or file system audit. Within 7 days: Either disable the Motorix theme and switch to an alternative theme, or remove it entirely from all affected WordPress installations. If continued use is mandatory, implement Web Application Firewall (WAF) rules to block suspicious file path traversal patterns in HTTP requests to theme directories. Within 30 days: Conduct full website security audit and review access logs for indicators of exploitation targeting the theme's include/require functions.

Motorix Theme CVE-2026-28026

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Motorix motorix allows PHP Local File Inclusion.This issue affects Motorix: from n/a through <= 1.6.

AnalysisAI

Local file inclusion in the Motorix WordPress theme versions 1.6 and earlier permits remote attackers to include and execute arbitrary PHP files on the server, despite high attack complexity. The vulnerability stems from improper validation of file paths in include/require statements. With EPSS exploitation probability at 0.15% (low percentile 36%), this appears to be a targeted WordPress theme vulnerability rather than widespread attack vector, though the CVSS score of 8.1 reflects the potential for complete system compromise if successfully exploited.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The Motorix theme, developed by ThemeREX for WordPress, fails to properly sanitize user-controllable input before passing it to PHP include() or require() functions. While categorized as a Remote File Inclusion vulnerability in the initial description, the tags and technical classification confirm this is actually an LFI issue. PHP file inclusion vulnerabilities allow attackers to manipulate file path parameters to include local files outside the intended directory structure, potentially accessing configuration files containing credentials, executing arbitrary PHP code through log poisoning or uploaded files, or reading sensitive system files. The AC:H (High Attack Complexity) in the CVSS vector suggests exploitation requires specific timing, winning a race condition, or guessing resource names rather than straightforward parameter manipulation.

Affected ProductsAI

WordPress Motorix theme by ThemeREX, versions 1.6 and all earlier versions (version range explicitly stated as 'from n/a through 1.6' in the vulnerability disclosure). The vulnerability was reported by Patchstack's security audit team and documented in their WordPress vulnerability database. Organizations can verify their installation by checking the theme version in WordPress admin panel under Appearance > Themes or by examining the style.css file in the theme directory for version metadata.

RemediationAI

Upgrade the Motorix theme to a patched version newer than 1.6 if available from ThemeREX. Check the official ThemeREX support channels and theme marketplace listing for updated releases. As an immediate mitigation, if upgrade is not possible, restrict access to the WordPress admin panel and theme files using web application firewall rules that block suspicious file path parameters containing directory traversal sequences (../, absolute paths, null bytes, or PHP protocol wrappers like php://). Implement file integrity monitoring on the theme directory to detect unauthorized modifications. Consider temporarily switching to an alternative WordPress theme if Motorix is not business-critical, as theme vulnerabilities can often be exploited through publicly accessible endpoints. Review web server logs for suspicious requests targeting theme files with unusual query parameters. Note that WAF rules blocking common LFI patterns may impact legitimate theme functionality, so test thoroughly in staging environments. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/motorix/vulnerability/wordpress-motorix-theme-1-6-local-file-inclusion-vulnerability should be monitored for updated remediation guidance and confirmation of patched versions.