What is the CVSS score of CVE-2026-28029?

CVE-2026-28029 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of EmojiNation Theme are affected by CVE-2026-28029?

ThemeREX EmojiNation WordPress theme (versions through 1.0.12) contains a local file inclusion vulnerability that enables remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2026-28029?

Within 24 hours: Identify all WordPress installations using ThemeREX EmojiNation theme version 1.0.12 or earlier via inventory or WordPress admin panels; disable or remove the theme immediately. Within 7 days: If theme functionality is required, migrate to an alternative WordPress theme with current security patches and conduct file access audit of web server logs (past 90 days) for suspicious file read patterns. Within 30 days: Perform credential audit and rotation for any sensitive data stored in web-accessible directories; implement web application firewall rules to block local file inclusion patterns; document remediation completion and update vulnerability tracking systems.

EmojiNation Theme CVE-2026-28029

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:11 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX EmojiNation emojination allows PHP Local File Inclusion.This issue affects EmojiNation: from n/a through <= 1.0.12.

AnalysisAI

Local file inclusion in ThemeREX EmojiNation WordPress theme versions through 1.0.12 allows remote attackers to read arbitrary files on the web server without authentication. Despite a CVSS score of 8.1, EPSS probability of 0.15% (36th percentile) suggests limited real-world exploitation activity. Patchstack database reports this as a PHP local file inclusion vulnerability with information disclosure impact, indicating attackers can access sensitive configuration files, credentials, or source code to facilitate subsequent attacks.

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98). The EmojiNation WordPress theme contains unsanitized file path handling that allows attackers to manipulate file inclusion mechanisms. Unlike remote file inclusion which loads external files, this local variant enables reading files already present on the server through path traversal techniques (e.g., ../../../etc/passwd). WordPress themes running under PHP are particularly susceptible when user-controllable input flows directly into include(), require(), or similar functions without proper validation. The vulnerability exists in theme code rather than WordPress core, affecting installations that have EmojiNation active regardless of WordPress version.

Affected ProductsAI

ThemeREX EmojiNation WordPress theme versions up to and including 1.0.12 are confirmed vulnerable per Patchstack database reporting. The vulnerability exists in theme-specific PHP code handling file inclusion operations. All WordPress installations with EmojiNation theme active or installed are potentially affected regardless of WordPress core version. The vendor advisory and complete version history are documented at https://patchstack.com/database/Wordpress/Theme/emojination/vulnerability/wordpress-emojination-theme-1-0-12-local-file-inclusion-vulnerability

RemediationAI

Immediate action required: Remove or deactivate EmojiNation theme from all WordPress installations as no patched version has been released beyond 1.0.12 according to available vendor data. Organizations requiring theme functionality should migrate to alternative actively-maintained WordPress themes from reputable developers. If theme removal is not immediately feasible, implement these compensating controls with noted limitations: Restrict WordPress admin access to trusted IP addresses via .htaccess rules (reduces attack surface but does not fix underlying code flaw), deploy web application firewall rules blocking common LFI patterns like '../' sequences in GET/POST parameters (bypassable via encoding techniques like %2e%2e%2f or double-encoding), enable PHP open_basedir directive to restrict file access to WordPress directory tree (may break legitimate theme functionality requiring access outside web root), and implement file integrity monitoring to detect unauthorized file access attempts. These mitigations reduce but do not eliminate risk. Permanent fix requires vendor patch release or theme replacement. Monitor Patchstack advisory for updates.