What is the CVSS score of CVE-2026-28061?

CVE-2026-28061 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Tiger Claw are affected by CVE-2026-28061?

ThemeREX Tiger Claw WordPress theme versions up to 1.1.14 contain a local file inclusion vulnerability (CVSS 8.1) that enables remote attackers to read arbitrary server files and potentially execute…

How to fix or mitigate CVE-2026-28061?

Within 24 hours: Inventory all WordPress installations using ThemeREX Tiger Claw theme and identify current version numbers. Within 7 days: Disable or remove the vulnerable theme from all affected sites; switch to alternative WordPress themes with demonstrated security track records. Within 30 days: Conduct file integrity audits on affected servers to identify any unauthorized access; review access logs for exploitation attempts targeting theme-specific endpoints.

Tiger Claw CVE-2026-28061

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tiger Claw tiger-claw allows PHP Local File Inclusion.This issue affects Tiger Claw: from n/a through <= 1.1.14.

AnalysisAI

Local file inclusion in ThemeREX Tiger Claw WordPress theme allows remote attackers to read arbitrary files from the web server and potentially execute code. Affects versions up to and including 1.1.14. Despite a high CVSS score of 8.1, the EPSS probability is low at 0.15% (36th percentile), suggesting limited exploitation attempts observed to date. No active exploitation confirmed by CISA KEV, though the vulnerability was reported by Patchstack's security research team.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98). While the CVE description mentions 'PHP Remote File Inclusion' in parentheses, the actual issue classification and Patchstack reference confirm this as Local File Inclusion (LFI). The Tiger Claw WordPress theme by ThemeREX contains vulnerable code that allows attacker-controlled input to influence file inclusion operations. In LFI attacks, path traversal sequences or null byte injection can force the application to include arbitrary local files, exposing sensitive configuration data (wp-config.php, .htaccess), server logs, or session files. If combined with file upload capabilities or log poisoning techniques, LFI can escalate to remote code execution by including attacker-controlled content.

Affected ProductsAI

ThemeREX Tiger Claw WordPress theme versions from unknown starting point through 1.1.14 (inclusive) are confirmed vulnerable. The vulnerability report originates from Patchstack's WordPress security database. Specific version ranges prior to 1.1.14 are not explicitly documented, though the notation 'from n/a through <= 1.1.14' suggests all versions up to this release are affected. Administrators can verify their installation by checking the theme version in WordPress admin dashboard under Appearance > Themes. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/tiger-claw/vulnerability/wordpress-tiger-claw-theme-1-1-14-local-file-inclusion-vulnerability.

RemediationAI

Upgrade ThemeREX Tiger Claw theme to version 1.1.15 or later if available, though the Patchstack advisory does not explicitly confirm a patched version number. Contact ThemeREX directly to verify patch availability and obtain the latest secure release. If immediate upgrade is not feasible, implement compensating controls: disable the Tiger Claw theme and switch to an alternative theme until patching is complete (no functional impact if theme is purely cosmetic); restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to limit exposure surface (trade-off: reduced administrative flexibility for remote teams); enable PHP open_basedir directive to confine file operations to WordPress directory tree, preventing traversal to sensitive system files (may break legitimate plugins relying on broader filesystem access). Review web server logs for suspicious requests containing path traversal patterns (../, %2e%2e/, etc.) targeting theme files. Advisory reference: https://patchstack.com/database/Wordpress/Theme/tiger-claw/vulnerability/wordpress-tiger-claw-theme-1-1-14-local-file-inclusion-vulnerability.