What is the CVSS score of CVE-2026-28034?

CVE-2026-28034 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Progress WordPress Theme are affected by CVE-2026-28034?

CVE-2026-28034 affects ThemeREX Progress WordPress theme version 1.2 and earlier, enabling remote attackers to read arbitrary files from web servers through local file inclusion vulnerabilities.

How to fix or mitigate CVE-2026-28034?

Within 24 hours: Identify all WordPress installations using ThemeREX Progress theme version 1.2 or earlier via plugin/theme inventory audit. Within 7 days: Disable or deactivate the vulnerable theme on all affected instances; if the theme is required for functionality, migrate to an alternative theme or contact ThemeREX for a version update status. Within 30 days: Conduct file access logs review for indicators of exploitation (suspicious file read patterns in web server logs) and implement Web Application Firewall (WAF) rules to block path traversal attempts targeting common sensitive files (wp-config.php, /etc/passwd patterns).

Progress WordPress Theme CVE-2026-28034

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:07 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Progress progress allows PHP Local File Inclusion.This issue affects Progress: from n/a through <= 1.2.

AnalysisAI

Local file inclusion in ThemeREX Progress WordPress theme version 1.2 and earlier allows remote attackers to read arbitrary files from the web server filesystem via PHP file inclusion flaws. Despite the 8.1 CVSS score, EPSS probability is low (0.15%, 36th percentile), indicating limited real-world exploitation activity. No CISA KEV listing confirms this remains a lower-priority vulnerability despite network reachability. Patchstack database identifies this as exploitable for information disclosure through local file access.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement) in the Progress WordPress theme by ThemeREX. PHP file inclusion vulnerabilities occur when user-controlled input is passed unsanitized to PHP functions like include(), require(), include_once(), or require_once(). The description indicates 'PHP Remote File Inclusion' but Patchstack tags this as Local File Inclusion (LFI), suggesting attackers can force the server to include local files from the filesystem rather than remote URLs. The discrepancy suggests either allow_url_include is disabled (preventing true RFI) or the vulnerability mechanism specifically targets local file paths. WordPress themes commonly introduce inclusion vulnerabilities through template loading mechanisms, AJAX handlers, or dynamic file loading based on GET/POST parameters.

Affected ProductsAI

ThemeREX Progress WordPress theme versions 1.2 and earlier are confirmed vulnerable per Patchstack database analysis. The CPE or precise version range prior to 1.2 is not specified in available data. This affects WordPress installations where Progress theme is active, particularly concerning for multi-site WordPress deployments or managed WordPress hosting environments. Vendor advisory or patch notification from ThemeREX not identified in provided references - Patchstack serves as the primary disclosure source.

RemediationAI

Update ThemeREX Progress theme to version 1.2.1 or later if available, though vendor-released patch version is not independently confirmed from provided data sources. Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/progress/vulnerability/wordpress-progress-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve should be consulted for latest patch status and specific remediation guidance. If no patched version exists, immediate compensating controls include: disable Progress theme and switch to a maintained alternative (eliminates attack surface entirely but requires site redesign); implement web application firewall rules blocking requests with path traversal sequences (../, .\, %2e%2e) in parameters to theme files (may break legitimate functionality requiring testing); restrict PHP file access permissions to prevent reading sensitive configuration files outside webroot (defense-in-depth but does not fix root cause); disable allow_url_include and allow_url_fopen in php.ini if RFI component exists (prevents remote file inclusion but not local file disclosure). Given the theme appears unmaintained (version 1.2 endpoint suggests development cessation), migration to actively supported theme is recommended long-term remediation.