What is the CVSS score of CVE-2026-28058?

CVE-2026-28058 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dixon WordPress Theme are affected by CVE-2026-28058?

ThemeREX Dixon WordPress theme versions up to 1.4.2.1 contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated remote attackers to read arbitrary server files, including…

How to fix or mitigate CVE-2026-28058?

Within 24 hours: Disable or remove ThemeREX Dixon theme from all WordPress installations; audit server logs for suspicious file-read requests (theme path parameters). Within 7 days: Switch to alternative WordPress theme and verify no sensitive files remain accessible via web paths; rotate any exposed credentials in wp-config.php or .env files. Within 30 days: Implement Web Application Firewall rules to block local file inclusion patterns; establish theme update monitoring process to prevent future vulnerable versions.

Dixon WordPress Theme CVE-2026-28058

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:51 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dixon dixon allows PHP Local File Inclusion.This issue affects Dixon: from n/a through <= 1.4.2.1.

AnalysisAI

Local file inclusion in ThemeREX Dixon WordPress theme through version 1.4.2.1 allows remote attackers to read arbitrary files from the server filesystem without authentication. Despite high attack complexity (AC:H), this vulnerability enables unauthorized access to sensitive configuration files, credentials, and potentially source code. EPSS score of 0.15% (36th percentile) indicates low probability of mass exploitation, consistent with targeting of a specific premium WordPress theme. No active exploitation confirmed (not in CISA KEV), but Patchstack public disclosure increases attack surface visibility.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement). The Dixon theme contains insecure file inclusion logic where user-controlled input is passed to PHP include() or require() functions without proper validation or sanitization. The CVSS vector AV:N indicates the vulnerable code is reachable via HTTP requests, likely through theme functionality that dynamically loads template files or components. Unlike remote file inclusion (RFI) which requires allow_url_include, local file inclusion (LFI) exploits path traversal to read files within the server's filesystem using sequences like '../../../' to escape intended directories. On WordPress installations, successful LFI can expose wp-config.php containing database credentials, .htaccess files, server logs, or /etc/passwd on Linux systems. The AC:H (high complexity) rating suggests exploitation requires specific conditions such as non-default configurations, precise timing, or knowledge of exact file paths on the target system.

Affected ProductsAI

ThemeREX Dixon WordPress theme versions from earliest release through 1.4.2.1 are vulnerable. The CPE designation would be cpe:2.3:a:themerex:dixon:*:*:*:*:*:wordpress:*:* with version range ending at 1.4.2.1. This is a commercial premium theme distributed through ThemeREX marketplace rather than the official WordPress.org repository, limiting the affected installation base. The Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/dixon/vulnerability/wordpress-dixon-theme-1-4-2-1-local-file-inclusion-vulnerability provides the authoritative vulnerability disclosure. Site administrators should audit WordPress installations for the Dixon theme, checking wp-content/themes/dixon/style.css header or WordPress dashboard under Appearance > Themes to confirm presence and version number.

RemediationAI

Immediately upgrade Dixon theme to version 1.4.3 or later if ThemeREX has released a patched version (verify availability at ThemeREX support portal or https://patchstack.com/database/Wordpress/Theme/dixon/). If no patch exists yet, implement defense-in-depth compensating controls: (1) Disable the Dixon theme and activate a maintained alternative theme until patch availability, noting this requires content/layout reconfiguration; (2) Restrict wp-admin access to known administrator IP addresses via .htaccess or firewall rules to prevent unauthenticated exploitation attempts; (3) Deploy Web Application Firewall rules to block path traversal patterns (../, %2e%2e%2f, encoded variants) in HTTP parameters, though this may cause false positives on legitimate file operations; (4) Enable PHP open_basedir restriction in php.ini to confine file access to WordPress directories, preventing reads of /etc/passwd or other system files-test thoroughly as this can break plugins expecting broader filesystem access; (5) Monitor web server access logs for unusual file parameter patterns or repeated 404/403 errors indicating exploitation reconnaissance. For high-security environments, consider removing Dixon theme entirely and migrating to actively maintained alternatives. Compensating controls provide partial risk reduction but theme upgrade or replacement is the definitive remediation.