What is the CVSS score of CVE-2026-28047?

CVE-2026-28047 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Victo WordPress Theme are affected by CVE-2026-28047?

The Magentech Victo WordPress theme (through version 1.4.16) contains a local file inclusion vulnerability that enables unauthenticated attackers to read arbitrary server files and potentially…

How to fix or mitigate CVE-2026-28047?

Within 24 hours: identify all WordPress installations using Magentech Victo theme version 1.4.16 or earlier via plugin/theme audit. Within 7 days: disable or remove the vulnerable theme from all production environments; switch to an alternative theme or contact Magentech for guidance on temporary workarounds. Within 30 days: monitor Magentech and Patchstack for patch release; establish process to apply vendor patches within 48 hours of release.

Victo WordPress Theme CVE-2026-28047

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 01:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.

AnalysisAI

Local file inclusion in Magentech Victo WordPress theme through version 1.4.16 allows remote attackers to read arbitrary server files and potentially execute code. Despite CWE-98 classification as 'Remote File Inclusion', technical evidence and Patchstack tagging confirm local file inclusion behavior. EPSS score of 0.15% (36th percentile) indicates low observed exploitation probability. No CISA KEV listing or public POC identified at time of analysis, though Patchstack reporting suggests researcher awareness of exploitation technique.

Technical ContextAI

CWE-98 vulnerabilities arise from improper sanitization of file paths in PHP include/require statements. The Victo theme, a commercial WordPress template by Magentech, contains insufficient input validation allowing attacker-controlled file paths to be passed to PHP file inclusion functions. While classified as 'PHP Remote File Inclusion' by CWE-98, the actual exploitation vector appears to be local file inclusion (LFI) based on Patchstack's technical tagging. LFI vulnerabilities enable reading of sensitive configuration files (wp-config.php, .htaccess), application source code, and system files (/etc/passwd). When combined with PHP wrapper exploitation (php://filter, data://) or log poisoning techniques, LFI can escalate to remote code execution. The 'Information Disclosure' tag suggests primary impact involves unauthorized file access rather than direct code execution, though the CVSS integrity and availability impacts (both High) indicate potential for more severe exploitation chains.

Affected ProductsAI

Magentech Victo WordPress theme versions from unspecified early release through version 1.4.16 are confirmed vulnerable per Patchstack advisory. No CPE data provided for precise version enumeration. The vulnerability affects WordPress installations where Victo theme is active, regardless of whether it is the primary active theme or installed as an alternate. Vendor advisory available at https://patchstack.com/database/Wordpress/Theme/victo/vulnerability/wordpress-victo-theme-1-4-16-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Magentech Victo theme to version 1.4.17 or later if available - patch version not independently confirmed from provided data sources. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/victo/vulnerability/wordpress-victo-theme-1-4-16-local-file-inclusion-vulnerability for vendor-specific remediation guidance. If immediate patching is not feasible, implement compensating controls: disable or remove Victo theme if not actively required for production use; restrict wp-admin access to trusted IP ranges via .htaccess or firewall rules to limit attack surface for theme configuration exploitation; enable WordPress application firewall (WAF) with rules blocking common LFI patterns in URL parameters (../, %2e%2e%2f, php://); monitor web server logs for suspicious file path traversal attempts in theme-related requests. Note that disabling unused themes eliminates risk entirely without functionality impact, while WAF rules may generate false positives requiring tuning for legitimate file operations.