What is the CVSS score of CVE-2026-28028?

CVE-2026-28028 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-28028?

Within 24 hours: inventory all WordPress installations using ThemeREX MoneyFlow theme and disable or remove the theme immediately; document affected systems and restrict web access if possible. Within 7 days: contact Patchstack and ThemeREX for available security updates or replacement themes; implement a Web Application Firewall (WAF) rule to block requests containing file inclusion patterns (e.g., '../', 'php://', 'etc/passwd') as interim protection. Within 30 days: migrate to a patched or alternative WordPress theme; conduct file integrity audits and access log review on affected servers for evidence of exploitation.

MoneyFlow WordPress Theme CVE-2026-28028

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:12 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 01:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.

AnalysisAI

Local file inclusion vulnerability in ThemeREX MoneyFlow WordPress theme version 1.0 and earlier enables remote attackers to read arbitrary files from the server filesystem and potentially execute PHP code. Reported by Patchstack security researchers, this vulnerability exploits improper validation of file paths in PHP include/require statements. With EPSS exploitation probability at 0.15% (36th percentile), widespread exploitation is not yet observed, though the network-accessible attack vector combined with high confidentiality, integrity, and availability impacts warrants immediate patching for sites using this theme.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly called PHP Local File Inclusion (LFI). The MoneyFlow WordPress theme fails to properly sanitize user-controlled input before passing it to PHP's include() or require() functions. While the CVE title references 'Remote File Inclusion', the Patchstack classification and CWE designation confirm this is actually Local File Inclusion. In LFI attacks, adversaries manipulate file path parameters to traverse the filesystem using sequences like '../' or absolute paths, forcing the application to include unintended local files. If combined with file upload capabilities or access to log files containing attacker-controlled data, LFI can escalate to remote code execution by including files with embedded PHP code. The affected product is a WordPress theme by ThemeREX, identified in Patchstack database as vulnerable through version 1.0.

Affected ProductsAI

ThemeREX MoneyFlow WordPress theme versions 1.0 and all earlier releases are vulnerable to this local file inclusion flaw. The vulnerability was identified and reported by Patchstack's security audit team (audit@patchstack.com). Detailed technical analysis and affected version confirmation is available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Theme/moneyflow/vulnerability/wordpress-moneyflow-theme-1-0-local-file-inclusion-vulnerability. Users of any MoneyFlow theme version should verify their installed version immediately and assume vulnerability unless running a patched release newer than 1.0.

RemediationAI

WordPress administrators running MoneyFlow theme must immediately upgrade to a patched version newer than 1.0 if available from ThemeREX. Check the theme's official repository or ThemeREX website for updated releases addressing CVE-2026-28028. Until a patch is applied, implement compensating controls: disable the MoneyFlow theme entirely and switch to a maintained, security-audited alternative theme; configure web application firewall rules to block requests containing directory traversal patterns (../, ..\ sequences) and absolute file paths in GET/POST parameters; enable PHP open_basedir restrictions in php.ini or .htaccess to limit file access to WordPress installation directories only, though this may break legitimate theme functionality requiring testing in staging environments; review server logs for suspicious requests targeting theme files with unusual path parameters. Monitor Patchstack database and ThemeREX security advisories for patch release announcements. Note that WAF rules may produce false positives on legitimate WordPress operations, requiring tuning, and open_basedir restrictions could impact theme features that legitimately access files outside standard WordPress directories.