What is the CVSS score of CVE-2026-28030?

CVE-2026-28030 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bonbon WordPress Theme are affected by CVE-2026-28030?

ThemeREX Bonbon WordPress theme versions up to 1.6 contain a local file inclusion vulnerability that allows attackers to read sensitive files and potentially execute code on affected web servers.

How to fix or mitigate CVE-2026-28030?

Within 24 hours: Identify all WordPress instances using ThemeREX Bonbon theme version 1.6 or earlier via site inspection or CMS auditing. Within 7 days: Either deactivate and replace the theme with a patched alternative, or implement WAF rules blocking requests to known vulnerable theme paths (e.g., /wp-content/themes/bonbon/). Within 30 days: Verify all file inclusions have been remediated and audit logs for any suspicious file access attempts post-identification.

Bonbon WordPress Theme CVE-2026-28030

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:10 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bonbon bonbon allows PHP Local File Inclusion.This issue affects Bonbon: from n/a through <= 1.6.

AnalysisAI

Local file inclusion in ThemeREX Bonbon WordPress theme through version 1.6 enables remote attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Reported by Patchstack audit team with a 0.15% EPSS score (low exploitation probability), this vulnerability allows unauthenticated network-based attacks despite high complexity requirements. No active exploitation confirmed via CISA KEV, though the LFI attack pattern is well-understood by attackers. PHP-based themes with improper include/require statement controls are common attack surfaces in WordPress environments.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability caused by improper control of filename parameters in include or require statements, classified under CWE-98. The Bonbon WordPress theme, developed by ThemeREX, fails to properly sanitize user-supplied input before using it in file inclusion functions. In PHP applications, when user-controllable data is passed directly to include(), require(), include_once(), or require_once() functions without adequate validation, attackers can manipulate file paths to access files outside the intended directory. While tagged as LFI, the CWE-98 classification 'PHP Remote File Inclusion' suggests potential for both local and remote file inclusion depending on PHP configuration settings like allow_url_include. The vulnerability exists in theme code rather than WordPress core, affecting sites using Bonbon versions up to and including 1.6.

Affected ProductsAI

ThemeREX Bonbon WordPress theme versions from earliest available release through version 1.6 are confirmed vulnerable based on Patchstack database records. The vulnerability exists in the theme's PHP code handling file inclusion operations. WordPress installations using Bonbon theme version 1.6 or earlier are at risk. No CPE identifiers provided in available data. Vendor advisory and detailed technical analysis available at Patchstack database reference link. Organizations should inventory WordPress sites to identify any installations using the Bonbon theme and check active theme version via WordPress admin dashboard under Appearance > Themes.

RemediationAI

Update ThemeREX Bonbon theme to version 1.6.1 or later if a patched version has been released by the vendor. Check the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Theme/bonbon/vulnerability/wordpress-bonbon-theme-1-6-local-file-inclusion-vulnerability for updated patch information and vendor response. If no patch is available or immediate update is not feasible, implement the following compensating controls: Disable the Bonbon theme and switch to a maintained alternative WordPress theme until patches are available. If the theme must remain active, implement Web Application Firewall (WAF) rules to block requests containing directory traversal sequences (../, ..../, %2e%2e%2f, etc.) in URL parameters and POST data, though this may break legitimate theme functionality if file paths are used in normal operations. Restrict PHP file inclusion capabilities by ensuring allow_url_include is set to Off in php.ini configuration, preventing remote file inclusion escalation (note: this is typically disabled by default in modern PHP but should be verified). Review web server access logs for suspicious requests containing file path manipulation attempts targeting the theme directory (typically /wp-content/themes/bonbon/). Each mitigation carries trade-offs: theme switching disrupts site appearance and may require redesign work; WAF rules risk false positives blocking legitimate requests; PHP configuration changes are server-wide and require hosting provider access.