CVE-2026-28046
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Law Office law-office allows PHP Local File Inclusion.This issue affects Law Office: from n/a through <= 3.3.0.
Analysis
ThemeREX Law Office plugin for PHP through version 3.3.0 is vulnerable to local file inclusion via improper handling of file include/require statements, enabling attackers to read arbitrary files on the affected server. An unauthenticated remote attacker can exploit this vulnerability over the network to access sensitive data without user interaction. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all instances of Law Office plugin ≤3.3.0 in your environment and document affected systems. Within 7 days: Implement WAF rules blocking suspicious include/require patterns and restrict file access permissions; disable the plugin if not critical to operations. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today