What is the CVSS score of CVE-2026-28051?

CVE-2026-28051 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Yacht Rental are affected by CVE-2026-28051?

ThemeREX Yacht Rental theme versions through 2.6 contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2026-28051?

Within 24 hours: Identify all WordPress installations using ThemeREX Yacht Rental theme and document current versions in use. Within 7 days: Disable or remove the vulnerable theme from production environments; migrate to an alternative theme or contact ThemeREX for an updated version beyond 2.6. Within 30 days: Implement a Web Application Firewall (WAF) rule set blocking PHP file inclusion patterns if theme removal is not immediately feasible, and conduct file access logs review for indicators of exploitation.

Yacht Rental CVE-2026-28051

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:57 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yacht Rental yacht-rental allows PHP Local File Inclusion.This issue affects Yacht Rental: from n/a through <= 2.6.

AnalysisAI

Local file inclusion in ThemeREX Yacht Rental theme versions through 2.6 enables remote attackers to read arbitrary files on the web server without authentication. The vulnerability stems from improper validation of include/require statements, classified as CWE-98 (PHP Remote File Inclusion). While CVSS scores 8.1 (High), the low EPSS score (0.15%, 36th percentile) suggests minimal observed exploitation activity. Patchstack audit team identified and reported this WordPress theme vulnerability, which affects default configurations requiring no special prerequisites beyond network access to the WordPress installation.

Technical ContextAI

This vulnerability exists in the Yacht Rental WordPress theme developed by ThemeREX, specifically in PHP code handling file inclusion operations. CWE-98 indicates improper control of filename parameters passed to PHP's include() or require() functions, allowing attackers to manipulate file paths. While classified as 'PHP Remote File Inclusion' in the CWE title, the tags and description confirm this is actually Local File Inclusion (LFI), meaning attackers can read existing files on the server rather than inject remote malicious code. The vulnerable code likely fails to sanitize user-supplied input before using it in file path construction, a common flaw in WordPress themes that dynamically load template files or configuration data. The WordPress ecosystem context is critical: themes run with the web server's privileges and have access to wp-config.php (containing database credentials), user data, and potentially other sensitive files.

Affected ProductsAI

ThemeREX Yacht Rental WordPress theme versions 2.6 and earlier are confirmed vulnerable per Patchstack database entry. The version range 'from n/a through 2.6' indicates all released versions up to and including 2.6 contain the flaw, with the initial vulnerable version unknown. This is a premium WordPress theme used for boat rental, yacht charter, and marine services websites. Organizations should check their WordPress installations at wp-content/themes/yacht-rental/ for version information, typically found in style.css header comments. The Patchstack reference (https://patchstack.com/database/Wordpress/Theme/yacht-rental/vulnerability/wordpress-yacht-rental-theme-2-6-local-file-inclusion-vulnerability) provides official vulnerability documentation and may contain updated remediation guidance.

RemediationAI

Immediate action required: update Yacht Rental theme to version 2.6.1 or later if available, verifying fix availability through ThemeREX support channels or the Patchstack advisory at the reference URL. Check ThemeREX official website or WordPress theme update mechanisms for patched releases. If no patch is immediately available, implement these compensating controls with noted trade-offs: (1) Temporarily deactivate the Yacht Rental theme and switch to a default WordPress theme like Twenty Twenty-Four until patch deployment-this breaks site functionality but eliminates exposure. (2) Implement web application firewall (WAF) rules blocking requests containing directory traversal patterns (../, %2e%2e%2f, absolute paths like /etc/passwd) to theme PHP files-may cause false positives for legitimate file upload features. (3) Restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules-reduces attack surface but impacts remote administration. (4) Enable PHP open_basedir restrictions in php.ini limiting file access to WordPress directory structure-prevents reading files outside webroot but requires server configuration access. Monitor web server logs for suspicious requests to yacht-rental theme files containing path manipulation attempts. Since Patchstack reported this vulnerability, their vPatch service may offer virtual patching for subscribers as temporary protection.