What is the CVSS score of CVE-2026-28054?

CVE-2026-28054 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Legal Stone are affected by CVE-2026-28054?

The Legal Stone WordPress theme versions 1.2.11 and earlier contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated remote attackers to read arbitrary files and…

How to fix or mitigate CVE-2026-28054?

Within 24 hours: Identify all WordPress installations using Legal Stone theme versions ≤1.2.11 via admin panel or security scanning tools; document affected sites. Within 7 days: Deactivate and remove the Legal Stone theme from all affected WordPress instances; deploy an alternative theme from the official WordPress repository. Within 30 days: Audit all removed theme directories for malicious files; review access logs for exploitation attempts; implement Web Application Firewall rules to block suspicious file inclusion patterns as a secondary control.

Legal Stone CVE-2026-28054

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legal Stone legal-stone allows PHP Local File Inclusion.This issue affects Legal Stone: from n/a through <= 1.2.11.

AnalysisAI

Local file inclusion in Legal Stone WordPress theme 1.2.11 and earlier allows remote attackers to read arbitrary files and potentially execute malicious code through improper filename control in PHP include/require statements. Exploitation probability remains low (EPSS 0.15%, 36th percentile) with no confirmed active exploitation, though the network-accessible attack vector and lack of authentication requirements present material risk for sites using this theme. Patchstack database reports this vulnerability affecting all versions through 1.2.11.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP security weakness where user-controlled input influences file paths in include(), require(), include_once(), or require_once() functions without proper validation. Legal Stone is a WordPress theme developed by ThemeREX for legal/law firm websites. The vulnerable code likely accepts user input (via GET/POST parameters, cookies, or HTTP headers) and passes it directly or with insufficient sanitization to a PHP file inclusion function. While classified as 'PHP Remote File Inclusion' in the description, the tags and Patchstack reference correctly identify this as Local File Inclusion (LFI). True RFI requires allow_url_include=On in php.ini, which is disabled by default in modern PHP. This discrepancy suggests the vulnerability primarily enables reading local server files rather than executing remote PHP payloads, though LFI can still lead to code execution via log poisoning, /proc/self/environ manipulation, or PHP filter chains.

Affected ProductsAI

WordPress theme Legal Stone by ThemeREX, all versions from initial release through version 1.2.11 inclusive. The CPE classification would follow wordpress_theme taxonomy. Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/legal-stone/vulnerability/wordpress-legal-stone-theme-1-2-11-local-file-inclusion-vulnerability confirms version 1.2.11 as the last known affected release. No specific WordPress core version dependencies are documented, though the vulnerability exists within the theme code itself rather than WordPress core.

RemediationAI

Organizations using Legal Stone theme should immediately upgrade to version 1.2.12 or later if available from ThemeREX, or consult the vendor advisory linked in Patchstack database for official patch guidance. If no patched version exists or upgrade is not immediately feasible, implement these compensating controls: disable the Legal Stone theme entirely and switch to a maintained alternative theme until patch deployment; configure web application firewall (WAF) rules to block requests containing directory traversal sequences (../, ..\ , %2e%2e%2f, encoded variants) and null bytes (%00) in query parameters and POST data targeting theme files under /wp-content/themes/legal-stone/, though this may break legitimate theme functionality requiring testing; restrict PHP open_basedir directive in php.ini or .htaccess to limit file system access to WordPress installation directory and temporary upload folders, preventing access to sensitive system files like /etc/passwd, though this requires server-level configuration access and may impact other applications. Review web server access logs for suspicious requests to Legal Stone theme endpoints containing path traversal patterns as indicators of exploitation attempts. Consult Patchstack reference at https://patchstack.com/database/Wordpress/Theme/legal-stone/vulnerability/wordpress-legal-stone-theme-1-2-11-local-file-inclusion-vulnerability for vendor-specific remediation guidance and exact patched version confirmation.