What is the CVSS score of CVE-2026-28050?

CVE-2026-28050 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Beacon WordPress Theme are affected by CVE-2026-28050?

ThemeREX Beacon WordPress theme versions 2.24 and earlier contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2026-28050?

Within 24 hours: Identify all WordPress installations using ThemeREX Beacon theme and document current versions. Within 7 days: Contact ThemeREX for confirmed patched version status independent of Patchstack advisory, or disable/replace the theme with an alternative pending vendor confirmation of a fix. Within 30 days: Apply the confirmed vendor-released patch to all affected installations once version is independently validated, or complete migration to a verified secure alternative theme.

Beacon WordPress Theme CVE-2026-28050

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Beacon beacon allows PHP Local File Inclusion.This issue affects Beacon: from n/a through <= 2.24.

AnalysisAI

Local file inclusion in ThemeREX Beacon WordPress theme versions ≤2.24 allows remote attackers to read arbitrary files from the web server through improper filename control in PHP include/require statements. Despite high-attack-complexity requirements (CVSS AC:H), this enables unauthenticated access to sensitive configuration files, credentials, and application source code. No public exploit identified at time of analysis, with low EPSS score (0.15%, 36th percentile) suggesting minimal observed exploitation activity. Patchstack advisory available but patched release version not independently confirmed.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP Remote/Local File Inclusion. The Beacon WordPress theme by ThemeREX fails to properly sanitize user-supplied input used in PHP include() or require() statements. When attackers control file path parameters, they can manipulate these statements to include arbitrary local files from the server filesystem rather than intended theme resources. This typically exploits insufficient validation of path traversal sequences (../) or null-byte injections in older PHP versions. While classified as 'PHP Remote File Inclusion' in the vulnerability description, the CWE-98 and technical reality indicate local file inclusion capability. The CPE context identifies this as a WordPress theme component (wordpress:theme scope), meaning the vulnerable code runs within WordPress's PHP execution environment with access to wp-config.php, database credentials, and other sensitive site files.

Affected ProductsAI

ThemeREX Beacon WordPress theme versions 2.24 and all earlier releases are confirmed vulnerable per Patchstack advisory. The vendor-specific CPE would be cpe:2.3:a:themerex:beacon:*:*:*:*:*:wordpress:*:* with version range through 2.24 inclusive. This affects WordPress sites that have installed and activated the Beacon theme from ThemeREX marketplace or ThemeForest. The vulnerability resides in theme-level PHP code rather than WordPress core. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/beacon/vulnerability/wordpress-beacon-theme-2-24-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Beacon theme to a version newer than 2.24 if available from ThemeREX-contact vendor directly or check ThemeForest/theme marketplace for latest release, as specific patched version number is not confirmed in available data. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/beacon/vulnerability/wordpress-beacon-theme-2-24-local-file-inclusion-vulnerability for vendor-specific guidance. If immediate upgrade is not feasible, implement compensating controls: disable unused Beacon theme features that accept file path parameters, configure web application firewall rules to block requests containing path traversal sequences (../, ..\ , %2e%2e%2f) in URL parameters and POST data targeting theme endpoints, restrict PHP open_basedir directive to WordPress installation directory to limit file inclusion scope (note: may break legitimate plugins expecting broader filesystem access), and enable comprehensive logging of file access attempts for incident detection. Review web server logs for suspicious requests to Beacon theme files with encoded traversal attempts. Consider temporarily switching to a different WordPress theme if Beacon is not mission-critical, as theme-switching carries lower operational risk than plugin removal.