What is the CVSS score of CVE-2026-28035?

CVE-2026-28035 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Printy WordPress Theme are affected by CVE-2026-28035?

CVE-2026-28035 affects ThemeREX Printy WordPress theme versions through 1.8, enabling remote attackers to read arbitrary server files and potentially execute code.

How to fix or mitigate CVE-2026-28035?

Within 24 hours: Inventory all WordPress installations and identify any running ThemeREX Printy theme version 1.8 or earlier. Within 7 days: Contact ThemeREX for patch availability and timeline; if unavailable, disable the vulnerable theme and switch to an alternative or disable the affected functionality. Within 30 days: Complete migration to a patched version or replacement theme once a fix is released, and audit server logs for suspicious file access patterns from the past 90 days.

Printy WordPress Theme CVE-2026-28035

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:06 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Printy printy allows PHP Local File Inclusion.This issue affects Printy: from n/a through <= 1.8.

AnalysisAI

Local file inclusion in ThemeREX Printy theme versions through 1.8 allows remote attackers to read arbitrary files from the web server filesystem and potentially achieve code execution. Despite high CVSS 8.1, EPSS exploitation probability is low at 0.15% (36th percentile), suggesting limited attacker interest. Patchstack has published vulnerability details, but no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper sanitization of user-controlled input used in PHP include/require statements (CWE-98), a classic local file inclusion flaw. The Printy WordPress theme by ThemeREX fails to validate filenames before using them in file operations, allowing path traversal sequences (e.g., ../../) to escape intended directories. While classified as 'PHP Remote File Inclusion' in the description, the CWE-98 mapping and LFI tag confirm this is local file inclusion-reading files from the server's filesystem rather than including remote URLs. WordPress themes often expose this vulnerability through template loading, AJAX handlers, or custom routing that accepts file path parameters without proper whitelisting or path canonicalization.

Affected ProductsAI

ThemeREX Printy WordPress theme versions from earliest release through version 1.8 are confirmed vulnerable per Patchstack advisory. The vulnerability affects WordPress installations where Printy is the active theme. No CPE identifier was provided in source data, and the version range start point is undefined (listed as 'n/a'), suggesting all versions up to and including 1.8 should be considered affected until vendor clarification. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/printy/vulnerability/wordpress-printy-theme-1-8-local-file-inclusion-vulnerability.

RemediationAI

Update Printy theme to a version newer than 1.8 if available from ThemeREX-check theme repository or contact vendor directly for patched release. If upgrade is not immediately feasible, implement compensating controls: restrict theme file permissions to prevent reads of sensitive files like wp-config.php, disable PHP error reporting to prevent path disclosure, implement Web Application Firewall rules blocking requests with path traversal sequences (../, ..\ , encoded variants %2e%2e%2f), and restrict file inclusion to explicitly whitelisted paths via open_basedir PHP directive (note: this may break legitimate theme functionality and requires testing). For production sites, consider temporarily switching to a different maintained theme until patch confirmation. Review web server logs for suspicious requests containing path traversal patterns to identify potential exploitation attempts. Advisory reference: https://patchstack.com/database/Wordpress/Theme/printy/vulnerability/wordpress-printy-theme-1-8-local-file-inclusion-vulnerability.