What is the CVSS score of CVE-2026-28031?

CVE-2026-28031 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Invetex WordPress Theme are affected by CVE-2026-28031?

CVE-2026-28031 is a high-severity local file inclusion vulnerability in ThemeREX Invetex WordPress theme (versions ≤2.18) that enables remote attackers to execute arbitrary PHP files and potentially…

How to fix or mitigate CVE-2026-28031?

Within 24 hours: Identify all WordPress installations using ThemeREX Invetex theme ≤2.18 and disable or remove the theme immediately. Within 7 days: Upgrade to ThemeREX Invetex version >2.18 if available, or switch to an alternative WordPress theme; audit access logs for suspicious file inclusion patterns (requests containing path traversal sequences). Within 30 days: Conduct full WordPress security audit including plugin/theme inventory, user access review, and malware scanning; implement Web Application Firewall (WAF) rules to block PHP file inclusion attempts.

Invetex WordPress Theme CVE-2026-28031

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:10 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Invetex invetex allows PHP Local File Inclusion.This issue affects Invetex: from n/a through <= 2.18.

AnalysisAI

Local file inclusion in ThemeREX Invetex WordPress theme versions ≤2.18 allows remote attackers to include and execute arbitrary PHP files from the server's filesystem, potentially leading to remote code execution, credential theft, or full site compromise. EPSS probability of 0.15% indicates relatively low observed exploitation despite network attack vector. Patchstack security audit identified the vulnerability in PHP file handling routines where inadequate validation enables path traversal to sensitive files.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement) in the Invetex WordPress theme by ThemeREX. The flaw occurs when user-controllable input is passed to PHP include() or require() functions without proper sanitization or path validation. Despite the CVE title mentioning 'PHP Remote File Inclusion,' the tags and description confirm this is Local File Inclusion (LFI), meaning attackers can only include files already present on the server rather than remote URLs. Typical vulnerable code patterns involve accepting file paths through GET/POST parameters (e.g., $_GET['page'], $_REQUEST['template']) and directly using them in include statements. In WordPress themes, this commonly affects template loading mechanisms or custom page handlers. The theme targets WordPress installations, making this a CMS-specific implementation vulnerability rather than core WordPress issue.

Affected ProductsAI

ThemeREX Invetex WordPress theme versions 2.18 and earlier are confirmed vulnerable. The version range 'from n/a through ≤2.18' indicates all historical versions are likely affected, with 2.18 being the last confirmed vulnerable release. This is a premium WordPress theme product, limiting exposure compared to widely distributed free themes. Vulnerability details and affected version confirmation available through Patchstack database at https://patchstack.com/database/Wordpress/Theme/invetex/vulnerability/wordpress-invetex-theme-2-18-local-file-inclusion-vulnerability (reference s_id=cve). CPE data not provided in available intelligence.

RemediationAI

Upgrade ThemeREX Invetex WordPress theme to version 2.19 or later if available (patch version not independently confirmed from provided data sources - verify with ThemeREX directly or consult https://patchstack.com/database/Wordpress/Theme/invetex/vulnerability/wordpress-invetex-theme-2-18-local-file-inclusion-vulnerability for latest patch status). If immediate upgrade is not feasible, implement these compensating controls: disable the Invetex theme and switch to a security-hardened alternative theme until patching is complete (eliminates attack surface entirely but requires design changes); implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, .\, %2e%2e/) in parameters passed to theme files, though sophisticated attackers may bypass filters using encoding or null-byte injection; restrict file system permissions so PHP processes cannot read sensitive files like /etc/passwd or wp-config.php (reduces impact but does not prevent exploitation); enable PHP open_basedir restrictions to limit file access to WordPress directories only (may break legitimate theme functionality requiring testing). Monitor web server logs for suspicious file path patterns in GET/POST parameters targeting Invetex theme endpoints.