What is the CVSS score of CVE-2026-28027?

CVE-2026-28027 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Kayon WordPress Theme are affected by CVE-2026-28027?

ThemeREX Kayon WordPress theme versions 1.3 and earlier contain a local file inclusion vulnerability (CVE-2026-28027) that could allow attackers to read sensitive files from affected web servers,…

How to fix or mitigate CVE-2026-28027?

Within 24 hours: Audit all WordPress installations to identify active use of ThemeREX Kayon theme and document affected versions. Within 7 days: Contact ThemeREX for patch timeline and evaluate alternative themes as interim mitigation; implement Web Application Firewall (WAF) rules to block malicious file inclusion patterns targeting the theme. Within 30 days: Either upgrade to a patched version once available or migrate to an alternative WordPress theme with current security maintenance; validate remediation through vulnerability scanning.

Kayon WordPress Theme CVE-2026-28027

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 01:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kayon kayon allows PHP Local File Inclusion.This issue affects Kayon: from n/a through <= 1.3.

AnalysisAI

Local file inclusion in ThemeREX Kayon WordPress theme versions through 1.3 enables remote attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Despite network-reachable attack vector (CVSS AV:N), exploitation requires high complexity conditions (AC:H) without authentication, resulting in a moderate EPSS score of 0.15% (36th percentile). Patchstack database lists this as an actively tracked vulnerability affecting WordPress installations, though no CISA KEV listing indicates limited widespread exploitation at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP file inclusion. The Kayon theme, developed by ThemeREX for WordPress, fails to properly validate or sanitize user-supplied input before passing it to PHP include/require functions. While classified as 'PHP Remote File Inclusion' in the title, Patchstack tags and technical indicators confirm this is actually a Local File Inclusion (LFI) vulnerability. LFI attacks exploit insufficient input validation in PHP file handling to access files outside the intended directory structure, typically using path traversal sequences. The affected product operates within the WordPress theming framework, where themes often dynamically load template files based on user requests or configuration parameters. The high CVSS score reflects potential for complete confidentiality, integrity, and availability compromise if an attacker chains LFI with other techniques like log poisoning or PHP wrapper exploitation to achieve code execution.

Affected ProductsAI

ThemeREX Kayon WordPress theme versions from earliest release through version 1.3 are confirmed vulnerable per Patchstack vulnerability database. This affects WordPress installations where Kayon is the active theme. The vulnerability resides in theme code rather than WordPress core, limiting exposure to sites specifically using this commercial theme product. Patchstack reference URL indicates ongoing tracking at https://patchstack.com/database/Wordpress/Theme/kayon/vulnerability/wordpress-kayon-theme-1-3-local-file-inclusion-vulnerability, though no vendor-issued security advisory from ThemeREX is referenced in available data.

RemediationAI

Upgrade Kayon theme to a version newer than 1.3 if ThemeREX has released a patched version - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kayon/vulnerability/wordpress-kayon-theme-1-3-local-file-inclusion-vulnerability for latest patch status, as no specific fixed version number is confirmed in NVD data. If no patch exists or immediate upgrade is not feasible, implement these compensating controls: disable the Kayon theme and switch to a maintained alternative WordPress theme until patches are available (eliminates attack surface entirely but requires theme migration effort and potential design changes); restrict PHP file inclusion capabilities by setting allow_url_include=Off and open_basedir restrictions in php.ini to limit file access scope (reduces LFI impact but may break legitimate theme functionality requiring testing); implement web application firewall rules to detect and block path traversal attempts in HTTP requests targeting theme endpoints (defense-in-depth measure but can be bypassed with encoding techniques); ensure wp-config.php and other sensitive files have restrictive permissions (640 or 600) and are located outside web root where possible (limits information disclosure if LFI succeeds but doesn't prevent exploitation). Monitor WordPress access logs for suspicious patterns like '../' sequences or unexpected file parameters in theme-related requests. Note that theme switching represents the most reliable mitigation but requires visual/functional equivalence validation.