Peter Mason WordPress Theme CVE-2026-28052
HIGHSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Peter Mason petermason allows PHP Local File Inclusion.This issue affects Peter Mason: from n/a through <= 1.4.5.
AnalysisAI
Local file inclusion in ThemeREX Peter Mason WordPress theme versions up to 1.4.5 allows remote unauthenticated attackers to include and execute arbitrary PHP files from the server's filesystem. The vulnerability stems from improper validation of file paths in include/require statements (CWE-98), enabling attackers to read sensitive files, execute malicious code, or escalate privileges. EPSS score of 0.15% (36th percentile) indicates relatively low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. Patchstack security research identified this flaw, suggesting security researchers are aware but widespread targeting is not yet evident.
Technical ContextAI
This is a PHP Remote/Local File Inclusion vulnerability (CWE-98) in a WordPress theme, specifically affecting ThemeREX's Peter Mason theme. The flaw occurs when the theme code uses unsanitized user input in PHP include() or require() statements without proper path validation or allowlist checking. While classified as 'PHP Remote File Inclusion' in the CWE mapping, the actual exploitability depends on PHP configuration: if allow_url_include is disabled (default since PHP 5.2), only local file inclusion is possible; if enabled, remote file execution becomes viable. WordPress themes commonly introduce such vulnerabilities through custom template loaders, AJAX handlers, or file routing mechanisms that accept file paths from GET/POST parameters. The affected product can be identified by CPE matching WordPress themes with vendor 'themerex' and product 'petermason', versions through 1.4.5.
Affected ProductsAI
ThemeREX Peter Mason WordPress theme versions from earliest release through 1.4.5 inclusive are confirmed vulnerable. This is a premium/commercial WordPress theme product, limiting the attack surface compared to widely-deployed free themes. The vulnerability exists in the theme's core PHP files handling include/require operations. Organizations can identify exposure by checking their WordPress installation's wp-content/themes/petermason directory and verifying theme version in style.css header or WordPress admin dashboard under Appearance > Themes. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/petermason/vulnerability/wordpress-peter-mason-theme-1-4-5-local-file-inclusion-vulnerability provides vendor-specific identification guidance.
RemediationAI
Primary remediation is updating Peter Mason theme to version 1.4.6 or later if ThemeREX has released a patched version (patch availability not confirmed in provided data sources as of analysis time). Organizations should check ThemeREX's official website or theme update notifications within WordPress admin dashboard for available updates. If no patch is released, implement these compensating controls: (1) Disable the Peter Mason theme and switch to a maintained alternative theme until a fix is available, which prevents exploitation but requires content/design migration effort. (2) Deploy a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns (../, %2e%2e%2f) or null byte injections (%00) to theme directories, though sophisticated attackers may bypass pattern-based filters. (3) Ensure PHP configuration has allow_url_include=Off (verify in php.ini), which limits exploitation to local files only and prevents remote code execution via HTTP wrappers, reducing impact severity. (4) Apply filesystem permissions restricting read access to sensitive files (wp-config.php, /etc/passwd) from the web server user, which limits information disclosure even if LFI succeeds. Consult the Patchstack advisory for specific vulnerable endpoints and consider blocking those URLs at the web server level if theme functionality permits. Monitor WordPress error logs and access logs for suspicious file path parameters targeting the theme directory.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-98 – PHP Remote File Inclusion
View allShare
External POC / Exploit Code
Leaving vuln.today