CVE-2026-28049
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Police Department police-department allows PHP Local File Inclusion.This issue affects Police Department: from n/a through <= 2.17.
Analysis
ThemeREX Police Department plugin version 2.17 and earlier for PHP contains a local file inclusion vulnerability that permits unauthenticated attackers to read arbitrary files on the server through improper input validation on include/require statements. An attacker can exploit this to access sensitive configuration files, credentials, or other confidential data stored on the affected web server.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems running ThemeREX Police Department and disable the plugin immediately. Within 7 days: Audit access logs for suspicious file inclusion attempts and review potentially exposed files. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today