What is the CVSS score of CVE-2026-28032?

CVE-2026-28032 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Tuning WordPress Theme are affected by CVE-2026-28032?

CVE-2026-28032 affects ThemeREX Tuning WordPress theme versions 1.3 and earlier, allowing remote attackers to read arbitrary files and potentially execute code through local file inclusion…

How to fix or mitigate CVE-2026-28032?

Within 24 hours: Inventory all WordPress installations using ThemeREX Tuning theme and identify current versions. Within 7 days: Disable or replace the ThemeREX Tuning theme with an alternative; if replacement is not feasible, restrict web server access to theme files and implement Web Application Firewall (WAF) rules to block local file inclusion patterns. Within 30 days: Monitor Patchstack and ThemeREX security advisories for patch availability; conduct file integrity monitoring on WordPress installations to detect unauthorized file access attempts.

Tuning WordPress Theme CVE-2026-28032

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:09 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tuning tuning allows PHP Local File Inclusion.This issue affects Tuning: from n/a through <= 1.3.

AnalysisAI

Local file inclusion in ThemeREX Tuning WordPress theme versions ≤1.3 enables remote attackers to read arbitrary files and potentially achieve code execution through PHP file inclusion mechanisms. Despite the high CVSS score (8.1), exploitation probability remains low (EPSS 0.15%, 36th percentile) and no active exploitation has been confirmed. Patchstack vulnerability database identifies this as affecting the Tuning theme through version 1.3, with the attack requiring high complexity network-based exploitation without authentication or user interaction.

Technical ContextAI

This vulnerability stems from improper sanitization of file path parameters used in PHP include/require statements (CWE-98). The Tuning WordPress theme fails to adequately validate user-supplied input before incorporating it into file inclusion operations, creating a classic local file inclusion (LFI) vector. While categorized as 'PHP Remote File Inclusion' in the description, the tags and technical classification indicate local file inclusion, meaning attackers can manipulate file paths to include local server files rather than remote URLs. WordPress themes often use dynamic file inclusion for template loading and feature modularity, making improper input validation in these contexts a critical security concern. The vulnerability allows traversal of the server filesystem to access sensitive files like wp-config.php, /etc/passwd, or PHP files that can be executed in the application context.

Affected ProductsAI

ThemeREX Tuning WordPress theme versions from earliest release through version 1.3 are confirmed vulnerable according to Patchstack database entry. The vulnerability affects WordPress installations using this theme regardless of WordPress core version. No CPE string is provided in source data. The Patchstack reference (https://patchstack.com/database/Wordpress/Theme/tuning/vulnerability/wordpress-tuning-theme-1-3-local-file-inclusion-vulnerability) serves as the primary vendor/researcher advisory for affected version confirmation.

RemediationAI

Upgrade ThemeREX Tuning theme to version 1.3.1 or later if available, verifying the fix through the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/tuning/vulnerability/wordpress-tuning-theme-1-3-local-file-inclusion-vulnerability. At time of analysis, no independently confirmed patched version number is available from provided data sources - site operators should check ThemeREX official channels and the Patchstack link for the latest secure release. If immediate upgrade is not feasible, implement compensating controls: disable the Tuning theme and switch to a maintained alternative until patching is possible; restrict WordPress admin access to trusted IP addresses only to prevent unauthorized theme installation/activation; enable PHP open_basedir restrictions to limit file inclusion scope to WordPress directory structures; implement web application firewall rules to detect and block directory traversal patterns in HTTP parameters (../../../, encoded variations). Note that WAF rules may cause false positives if the theme legitimately uses file path parameters. These mitigations reduce but do not eliminate risk - upgrading remains the only complete remediation.