What is the CVSS score of CVE-2026-28033?

CVE-2026-28033 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Edifice WordPress Theme are affected by CVE-2026-28033?

CVE-2026-28033 affects ThemeREX Edifice WordPress theme through version 1.8, enabling unauthenticated remote attackers to read arbitrary server files and potentially execute PHP code despite high…

How to fix or mitigate CVE-2026-28033?

Within 24 hours: Identify all WordPress instances using ThemeREX Edifice theme version 1.8 or earlier and disable the theme pending updates. Within 7 days: Contact ThemeREX for patched version availability and test upgrade path in non-production environment. Within 30 days: Upgrade all affected instances to a patched version when available, or implement Web Application Firewall rules to block malicious file inclusion parameters targeting theme components.

Edifice WordPress Theme CVE-2026-28033

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:08 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Edifice edifice allows PHP Local File Inclusion.This issue affects Edifice: from n/a through <= 1.8.

AnalysisAI

Local file inclusion in ThemeREX Edifice WordPress theme through version 1.8 allows remote attackers to read arbitrary files on the server and potentially execute PHP code by manipulating file inclusion parameters. Exploitation requires bypassing a high attack complexity barrier (AC:H) without authentication, making this a critical vulnerability for websites using affected versions. EPSS score of 0.15% indicates minimal observed exploitation activity in the wild, and no CISA KEV listing exists at time of analysis.

Technical ContextAI

This vulnerability stems from improper sanitization of user-controlled input in PHP include() or require() statements, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). While the CVE title references 'PHP Remote File Inclusion', the tags and Patchstack classification confirm this is a Local File Inclusion (LFI) vulnerability. The Edifice theme fails to properly validate file paths before passing them to PHP file inclusion functions, allowing attackers to traverse the filesystem using path manipulation techniques (e.g., '../' sequences) to include arbitrary files. In PHP environments with certain configurations, LFI can escalate to remote code execution if attackers can inject PHP code through log files, session files, or uploaded content and then include those files for execution.

Affected ProductsAI

The vulnerability affects ThemeREX Edifice WordPress theme versions from an unspecified starting version through version 1.8 inclusive. The specific CPE or comprehensive version range is not provided in available data, and the starting affected version is documented as 'n/a', suggesting all versions up to and including 1.8 may be vulnerable. The Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Theme/edifice/vulnerability/wordpress-edifice-theme-1-8-local-file-inclusion-vulnerability) serves as the primary reference for affected product identification.

RemediationAI

Upgrade ThemeREX Edifice WordPress theme to version 1.8.1 or later if available from the vendor. Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/edifice/vulnerability/wordpress-edifice-theme-1-8-local-file-inclusion-vulnerability should be consulted for the latest patch information. If immediate patching is not feasible, implement compensating controls: restrict access to WordPress admin panel via IP whitelisting to prevent theme installation manipulation; disable PHP file execution in the wp-content/themes/edifice directory via .htaccess rules (note this may break theme functionality); implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in requests targeting the theme directory; monitor web server logs for suspicious include/require patterns or directory traversal attempts (../, %2e%2e%2f). These workarounds reduce but do not eliminate risk, and may impact theme functionality, so regression testing is required before production deployment.