CVE-2026-28059
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dermatology Clinic dermatology-clinic allows PHP Local File Inclusion.This issue affects Dermatology Clinic: from n/a through <= 1.4.3.
Analysis
ThemeREX Dermatology Clinic plugin for PHP versions up to 1.4.3 contains a local file inclusion vulnerability in its filename handling logic that allows unauthenticated attackers to read sensitive files from the server. An attacker can exploit this vulnerability over the network without user interaction to access arbitrary files and potentially execute code on affected systems. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all instances of Dermatology Clinic plugin ≤1.4.3 across web properties and isolate or disable affected instances if operationally feasible. Within 7 days: Implement WAF rules blocking suspicious file inclusion patterns, apply input validation controls, and conduct vulnerability scanning of affected systems. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today