What is the CVSS score of CVE-2026-28049?

CVE-2026-28049 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Police Department are affected by CVE-2026-28049?

CVE-2026-28049 is a high-severity local file inclusion vulnerability affecting the Police Department WordPress theme through version 2.17 that enables remote attackers to read arbitrary server files…

How to fix or mitigate CVE-2026-28049?

Within 24 hours: Identify all WordPress instances using Police Department theme version 2.17 or earlier and disable the theme. Within 7 days: Review web server logs for suspicious file inclusion requests (patterns like ../ or /etc/passwd) and any unauthorized file access. Within 30 days: Contact the theme vendor for patch availability; if unavailable, migrate to an alternative maintained WordPress theme with a security-focused vendor.

Police Department CVE-2026-28049

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:59 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Police Department police-department allows PHP Local File Inclusion.This issue affects Police Department: from n/a through <= 2.17.

AnalysisAI

Local file inclusion in the Police Department WordPress theme through version 2.17 allows remote attackers to read arbitrary files on the server and potentially achieve remote code execution through file disclosure and log poisoning techniques. Discovered by Patchstack's audit team, this vulnerability carries an EPSS score of 0.15%, indicating low probability of widespread exploitation despite its network-accessible attack vector. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements within the Police Department WordPress theme by ThemeREX. Classified as CWE-98 (Improper Control of Filename for Include/Require Statement), the flaw allows attackers to manipulate file path parameters to include local files outside the intended directory structure. While labeled 'PHP Remote File Inclusion' in the description, the tags and Patchstack reference confirm this is actually Local File Inclusion (LFI). The distinction matters: LFI reads server-local files, while RFI executes remote code directly. In WordPress themes, LFI vulnerabilities typically occur in template loaders, AJAX handlers, or custom routing logic that improperly sanitizes user-supplied file paths before passing them to include(), require(), or related functions.

Affected ProductsAI

The vulnerability affects the Police Department WordPress theme by ThemeREX, versions from earliest available release through version 2.17 inclusive. The Patchstack advisory URL (https://patchstack.com/database/Wordpress/Theme/police-department/vulnerability/wordpress-police-department-theme-2-17-local-file-inclusion-vulnerability) serves as the primary vendor reference. No specific CPE identifier was provided in the source data. WordPress installations using this theme in any configuration are potentially vulnerable.

RemediationAI

Upgrade the Police Department theme to a patched version newer than 2.17. According to the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/police-department/vulnerability/wordpress-police-department-theme-2-17-local-file-inclusion-vulnerability, a fix should be available. If immediate patching is not feasible, implement the following compensating controls: disable the Police-department theme and switch to a different WordPress theme until patching is complete, as this eliminates the vulnerable code path entirely; restrict direct access to theme files by configuring web server rules to block direct requests to .php files in wp-content/themes/police-department/ except index.php (though this may break legitimate theme functionality requiring testing); enable PHP disable_functions directive to block sensitive file operations like show_source, highlight_file, and symlink which attackers commonly leverage post-LFI (side effect: may break plugins using these functions legitimately). Monitor web server access logs for suspicious requests containing path traversal patterns like '../' or '%2e%2e%2f' targeting the theme directory. Note that Web Application Firewall rules blocking traversal sequences provide detection but determined attackers may bypass them through encoding variations.