What is the CVSS score of CVE-2026-28041?

CVE-2026-28041 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Grit WordPress Theme are affected by CVE-2026-28041?

AncoraThemes Grit WordPress theme versions 1.0.1 and earlier contain a local file inclusion vulnerability (CVE-2026-28041) that allows unauthenticated attackers to read, modify, or disrupt arbitrary…

How to fix or mitigate CVE-2026-28041?

Within 24 hours: Identify all WordPress installations using AncoraThemes Grit theme via admin dashboard or database query; document affected versions. Within 7 days: Disable or deactivate the Grit theme; switch to an alternative theme and apply theme update if available from vendor. Within 30 days: Monitor Patchstack and AncoraThemes official channels for vendor-released patch to version 1.0.2 or later; verify patch deployment before re-enabling.

Grit WordPress Theme CVE-2026-28041

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:04 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Grit grit allows PHP Local File Inclusion.This issue affects Grit: from n/a through <= 1.0.1.

AnalysisAI

Local File Inclusion in AncoraThemes Grit WordPress theme (versions ≤1.0.1) allows remote attackers to include arbitrary local files through improper validation of PHP include/require statements. Attack requires high complexity (CVSS AC:H) but no authentication, enabling unauthenticated attackers to achieve high confidentiality, integrity, and availability impact. EPSS score of 0.15% (36th percentile) indicates relatively low mass exploitation probability despite network attack vector. Patchstack audit team identified this vulnerability affecting PHP-based file operations with potential for information disclosure.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The Grit WordPress theme fails to properly sanitize user-controlled input passed to PHP include() or require() functions, allowing attackers to manipulate file paths. While categorized as PHP Remote File Inclusion in the title, tags and references confirm this is Local File Inclusion, meaning attackers can force the application to include local files from the server filesystem rather than remote URLs. WordPress themes written in PHP are particularly vulnerable when they dynamically construct file paths for template loading or configuration includes without proper validation. The vulnerability exists in AncoraThemes' Grit theme through version 1.0.1, affecting PHP-based WordPress installations running this theme.

Affected ProductsAI

AncoraThemes Grit WordPress theme versions from earliest release through version 1.0.1 inclusive are confirmed vulnerable per Patchstack database entry. This affects WordPress installations (any version) where Grit theme is active or installed. The vulnerability is inherent to the theme code itself rather than WordPress core. No CPE identifier was provided in available data. Vendor advisory and detailed technical information available at https://patchstack.com/database/Wordpress/Theme/grit/vulnerability/wordpress-grit-theme-1-0-1-local-file-inclusion-vulnerability.

RemediationAI

Primary mitigation is upgrading Grit theme to a patched version beyond 1.0.1 if available - check AncoraThemes official channels or WordPress theme repository for updates (exact fixed version not confirmed in available data). If no patch exists, immediately deactivate and replace Grit theme with an alternative WordPress theme, as active themes present exploitable attack surface. Compensating controls if theme replacement is delayed: restrict WordPress admin access to trusted IPs only via .htaccess or firewall rules to limit attack vector; implement Web Application Firewall (WAF) rules to block requests containing directory traversal sequences (../, %2e%2e%2f) and PHP wrappers (php://, file://, expect://) in theme-related parameters; enable WordPress security hardening including disabling PHP file execution in uploads directory; monitor server logs for suspicious file access patterns to wp-content/themes/grit/. Note that WAF rules may cause false positives with legitimate theme customization workflows. For detailed vulnerability specifics consult Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/grit/vulnerability/wordpress-grit-theme-1-0-1-local-file-inclusion-vulnerability.