What is the CVSS score of CVE-2026-28059?

CVE-2026-28059 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dermatology Clinic are affected by CVE-2026-28059?

The ThemeREX Dermatology Clinic WordPress theme versions 1.4.3 and below contain a local file inclusion vulnerability that could allow attackers to execute arbitrary PHP code on affected web servers.

How to fix or mitigate CVE-2026-28059?

Within 24 hours: Audit all WordPress installations for ThemeREX Dermatology Clinic theme and document current versions. Within 7 days: Contact ThemeREX for patch availability; if unavailable, deactivate the theme and switch to an alternative theme (consider Astra, OceanWP, or GeneratePress for healthcare sites). Within 30 days: Complete migration to patched or replacement theme, verify all website functionality, and implement Web Application Firewall (WAF) rules to block common LFI payloads (e.g., directory traversal patterns with '../').

Dermatology Clinic CVE-2026-28059

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:50 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dermatology Clinic dermatology-clinic allows PHP Local File Inclusion.This issue affects Dermatology Clinic: from n/a through <= 1.4.3.

AnalysisAI

Local File Inclusion (LFI) vulnerability in ThemeREX Dermatology Clinic WordPress theme versions ≤1.4.3 allows remote attackers to include and execute arbitrary PHP files on the server. Despite CVSS 8.1, EPSS score of 0.15% (36th percentile) indicates low probability of mass exploitation. Patchstack database confirms the vulnerability but no CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world targeting of this WordPress theme.

Technical ContextAI

The vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98: PHP Remote File Inclusion). The WordPress theme fails to sanitize user-supplied input used in file inclusion operations, allowing path traversal sequences or direct file path manipulation. While classified as PHP Remote File Inclusion, tags and description indicate Local File Inclusion behavior, meaning attackers can access files already present on the server rather than including remote URLs. This discrepancy between the CWE classification and actual behavior is common when allow_url_include is disabled in PHP configuration. The theme likely uses dynamic file inclusion for template loading or configuration management without proper path validation against directory traversal attacks.

Affected ProductsAI

ThemeREX Dermatology Clinic WordPress theme versions from unknown starting point through version 1.4.3 are confirmed vulnerable. The vendor is ThemeREX and the product is specifically their Dermatology Clinic theme available through WordPress theme marketplaces. Patchstack vulnerability database provides confirmation at https://patchstack.com/database/Wordpress/Theme/dermatology-clinic/vulnerability/wordpress-dermatology-clinic-theme-1-4-3-local-file-inclusion-vulnerability. No CPE identifier was provided in available data. Organizations should audit WordPress installations for this specific theme rather than assuming broader WordPress exposure.

RemediationAI

Primary remediation is upgrading Dermatology Clinic theme to version 1.4.4 or later if available, though patched version number is not independently confirmed from vendor sources at time of analysis. Contact ThemeREX directly for patch availability or consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/dermatology-clinic/vulnerability/wordpress-dermatology-clinic-theme-1-4-3-local-file-inclusion-vulnerability for updated remediation guidance. If immediate patching is not feasible, implement compensating controls: disable the Dermatology Clinic theme and switch to a maintained alternative theme (causes visual/functionality changes requiring testing), restrict WordPress administrative access to trusted IP ranges via web application firewall rules (reduces attack surface but does not eliminate vulnerability if attackers gain initial access), and enable PHP open_basedir restrictions to limit file system access to WordPress directories only (may cause compatibility issues with plugins expecting broader file access). Monitor WordPress access logs for suspicious file parameter patterns or path traversal sequences as detection measure.