What is the CVSS score of CVE-2026-28057?

CVE-2026-28057 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Mandala WordPress Theme are affected by CVE-2026-28057?

ThemeREX Mandala WordPress theme versions 2.8 and earlier contain a local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive server files or execute arbitrary…

How to fix or mitigate CVE-2026-28057?

Within 24 hours: Identify all WordPress installations using ThemeREX Mandala theme and document current version numbers. Within 7 days: Update ThemeREX Mandala to version 2.9 or later (contact vendor for availability or replacement theme). Within 30 days: Conduct a security audit of affected servers to identify any unauthorized file access in logs; review and rotate any exposed credentials found in configuration files.

Mandala WordPress Theme CVE-2026-28057

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:51 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mandala mandala allows PHP Local File Inclusion.This issue affects Mandala: from n/a through <= 2.8.

AnalysisAI

Local file inclusion in ThemeREX Mandala WordPress theme versions ≤2.8 allows remote unauthenticated attackers to read arbitrary server files and potentially execute PHP code through improper filename control in include/require statements. Despite a CVSS score of 8.1, the EPSS probability remains low (0.15%, 36th percentile), suggesting limited attacker interest or exploitation barriers. No active exploitation or public proof-of-concept has been identified, and the vulnerability requires high attack complexity (AC:H), indicating specific conditions must be met for successful exploitation.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly occurring when PHP applications use unsanitized user input in include(), require(), include_once(), or require_once() functions. The Mandala WordPress theme by ThemeREX allows attackers to manipulate file path parameters, enabling Local File Inclusion (LFI) attacks. While classified as LFI, the network attack vector (AV:N) means remote attackers can exploit it without local system access. LFI vulnerabilities in WordPress themes typically arise from unsafe handling of template loading, dynamic resource inclusion, or AJAX endpoints that accept file path parameters. Successful exploitation can expose configuration files (/wp-config.php), server logs, or /etc/passwd, and in specific PHP configurations (e.g., allow_url_include enabled or exploitable PHP wrappers), may escalate to remote code execution.

Affected ProductsAI

ThemeREX Mandala WordPress theme versions 2.8 and earlier are confirmed vulnerable. The advisory from Patchstack (https://patchstack.com/database/Wordpress/Theme/mandala/vulnerability/wordpress-mandala-theme-2-8-local-file-inclusion-vulnerability?_s_id=cve) provides specific version confirmation. All WordPress installations using Mandala theme version 2.8 or below are at risk, regardless of WordPress core version. The vulnerability resides in the theme code itself, not WordPress core or specific hosting environments.

RemediationAI

Upgrade ThemeREX Mandala theme to version 2.9 or later if available (verify patched version from vendor advisory at https://patchstack.com/database/Wordpress/Theme/mandala/vulnerability/wordpress-mandala-theme-2-8-local-file-inclusion-vulnerability?_s_id=cve). If no patched version exists, implement compensating controls: disable the Mandala theme and switch to a maintained alternative WordPress theme until vendor releases a fix. As additional defense layers, ensure PHP configuration has allow_url_include set to Off (default in PHP 7.4+), restrict PHP functions like include/require using disable_functions directive in php.ini for WordPress processes if operationally feasible, and apply Web Application Firewall rules to block suspicious file path patterns (../, /etc/passwd, wp-config.php) in HTTP parameters. Review WordPress access logs for attempts to access .php files with unusual query parameters. Note that WAF rules may produce false positives with legitimate WordPress plugin behavior; monitor and tune rules accordingly. If theme customization prevents switching, conduct immediate code audit of all include/require statements in Mandala theme files to identify and sanitize vulnerable parameters.