What is the CVSS score of CVE-2026-28055?

CVE-2026-28055 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of williamson are affected by CVE-2026-28055?

A local file inclusion vulnerability in the M.Williamson WordPress theme (versions up to 1.2.11) allows unauthenticated attackers to read arbitrary server files, posing a direct risk to sensitive…

How to fix or mitigate CVE-2026-28055?

24 hours: Identify all WordPress installations using M.Williamson theme via admin dashboard or server inventory; document current version numbers. 7 days: Disable or remove the M.Williamson theme; migrate to an actively maintained alternative theme with security updates; audit server logs for suspicious file access patterns. 30 days: Implement Web Application Firewall (WAF) rules blocking LFI patterns (../, file= parameters) if theme replacement is delayed; conduct credential rotation for any database and system accounts referenced in exposed files.

williamson CVE-2026-28055

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:53 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX M.Williamson williamson allows PHP Local File Inclusion.This issue affects M.Williamson: from n/a through <= 1.2.11.

AnalysisAI

Local file inclusion in the M.Williamson WordPress theme through version 1.2.11 enables remote attackers to read arbitrary files from the server filesystem without authentication. Despite high-complexity exploitation barriers (CVSS AC:H), this vulnerability carries an 8.1 CVSS score due to complete compromise of confidentiality and integrity if successfully exploited. EPSS score of 0.15% (36th percentile) suggests low probability of mass exploitation. No active exploitation confirmed via CISA KEV, though Patchstack database inclusion indicates researcher discovery and analysis.

Technical ContextAI

This vulnerability stems from improper sanitization of file paths in PHP include/require statements (CWE-98), a classic web application weakness where user-controlled input influences file inclusion operations. The M.Williamson WordPress theme fails to validate file path parameters before passing them to PHP's include() or require() functions. While classified as 'PHP Remote File Inclusion' in the description, the tags and CWE correctly identify this as Local File Inclusion (LFI), meaning attackers can access files already present on the server rather than injecting remote code. In WordPress themes, LFI typically occurs through template loading mechanisms or asset handlers that accept file parameters via GET/POST requests. Successful exploitation allows reading sensitive configuration files (wp-config.php, .htaccess), database credentials, session tokens, or source code.

Affected ProductsAI

The M.Williamson WordPress theme versions up to and including 1.2.11 developed by ThemeREX are affected by this local file inclusion vulnerability. The vulnerability disclosure indicates all versions prior to an unspecified patched release contain the flaw, suggesting a legacy codebase issue rather than a recent regression. No CPE identifier was provided in the source data, and vendor advisory availability from ThemeREX has not been independently confirmed. The Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/williamson/vulnerability/wordpress-m-williamson-theme-1-2-11-local-file-inclusion-vulnerability serves as the primary reference for affected version information.

RemediationAI

Immediately upgrade the M.Williamson theme to a version newer than 1.2.11 if available from ThemeREX or the WordPress theme repository - consult https://patchstack.com/database/Wordpress/Theme/williamson/vulnerability/wordpress-m-williamson-theme-1-2-11-local-file-inclusion-vulnerability for update availability. If no patched version exists or immediate upgrade is not feasible, implement these compensating controls: disable the M.Williamson theme entirely and switch to an actively maintained alternative (preferred option), restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to prevent theme file manipulation, enable WordPress security plugins with virtual patching capabilities (WordFence, Sucuri) configured to block path traversal attempts in GET/POST parameters, configure web application firewall rules to reject requests containing '../', '%2e%2e%2f', or null byte sequences in URL parameters. Note that WAF rules may cause false positives with legitimate file operations - test thoroughly in staging environments. Monitor web server logs for suspicious file access patterns (requests to wp-config.php, /etc/passwd). These mitigations reduce but do not eliminate risk; theme replacement remains the only complete solution.