Is PHP affected by CVE-2026-28060?

A critical file inclusion vulnerability in ThemeREX S.King (versions ≤1.5.3) allows attackers to read sensitive local files from affected servers, potentially exposing database credentials, configuration files, and other confidential data.

CVE-2026-28060

Q: How to fix CVE-2026-28060?

Within 24 hours: Identify all WordPress installations using S.King theme and document affected systems; implement WAF rules to block suspicious file inclusion patterns; disable the vulnerable plugin/theme if operationally feasible. Within 7 days: Apply network segmentation to restrict affected servers' outbound connections; enable enhanced logging and monitoring for file access anomalies; conduct inventory of exposed sensitive files. Within 30 days: Upgrade to patched version when available; rotate all credentials accessed by affected systems; perform forensic review of access logs for evidence of exploitation.

HIGH

2026-03-05 [email protected]

8.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX S.King stephanie-king allows PHP Local File Inclusion.This issue affects S.King: from n/a through <= 1.5.3.

Analysis

Local file inclusion in ThemeREX S.King through version 1.5.3 enables unauthenticated attackers to read arbitrary files from the server through improper handling of include/require statements in PHP. This high-severity vulnerability (CVSS 8.1) allows disclosure of sensitive information and potential code execution, with no patch currently available.

Remediation

Within 24 hours: Identify all WordPress installations using S.King theme and document affected systems; implement WAF rules to block suspicious file inclusion patterns; disable the vulnerable plugin/theme if operationally feasible. Within 7 days: Apply network segmentation to restrict affected servers' outbound connections; enable enhanced logging and monitoring for file access anomalies; conduct inventory of exposed sensitive files. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +40

POC: 0

CVE-2026-28060 vulnerability details – vuln.today

Back

CVE-2026-28060

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-28060

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code