What is the CVSS score of CVE-2026-28062?

CVE-2026-28062 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Happy Baby are affected by CVE-2026-28062?

CVE-2026-28062 is a high-severity local file inclusion vulnerability in ThemeREX Happy Baby WordPress theme (≤1.2.12) that enables unauthenticated remote attackers to read arbitrary server files and…

How to fix or mitigate CVE-2026-28062?

Within 24 hours: Inventory all WordPress installations using ThemeREX Happy Baby theme and document current versions; disable or deactivate the theme immediately if version ≤1.2.12 is identified. Within 7 days: Either upgrade to version >1.2.12 when available or replace with an alternative supported WordPress theme; apply a Web Application Firewall (WAF) rule to block suspicious file inclusion patterns (e.g., requests containing 'wp-load.php' or directory traversal sequences). Within 30 days: Conduct a security audit of affected WordPress installations for signs of unauthorized file access or PHP execution; implement application allow-listing for uploaded files and restrict file inclusion to a specific directory.

Happy Baby CVE-2026-28062

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through <= 1.2.12.

AnalysisAI

Local file inclusion in ThemeREX Happy Baby WordPress theme versions ≤1.2.12 allows remote unauthenticated attackers to read arbitrary files from the web server and potentially execute PHP code. Patchstack reported this vulnerability (CWE-98) affecting file inclusion controls, though EPSS probability remains low at 0.15% with no confirmed active exploitation. The CVSS vector indicates network-based attack with high complexity but no authentication requirement, enabling confidentiality, integrity, and availability compromise.

Technical ContextAI

This is a PHP Remote/Local File Inclusion (RFI/LFI) vulnerability (CWE-98) in the Happy Baby WordPress theme by ThemeREX. The flaw stems from improper validation of file paths in PHP include/require statements, allowing attackers to manipulate filename parameters to reference files outside the intended directory. WordPress themes commonly use dynamic file inclusion for template loading, and inadequate sanitization of user-supplied input to these functions creates path traversal opportunities. The vulnerability affects Happy Baby theme versions through 1.2.12, indicating all versions up to and including this release contain the flaw. The discrepancy between 'PHP Remote File Inclusion' in the title and 'PHP Local File Inclusion' in the description suggests the vulnerability primarily enables LFI attacks, though the exact attack vector depends on PHP configuration (allow_url_include settings).

Affected ProductsAI

ThemeREX Happy Baby WordPress theme versions from earliest release through 1.2.12 inclusive are confirmed vulnerable. The 'from n/a' notation indicates all historical versions contain this flaw. The vulnerability resides in PHP file inclusion mechanisms within the theme code. Administrators running Happy Baby theme on any WordPress installation should verify their version immediately. Patchstack vulnerability database provides tracking at https://patchstack.com/database/Wordpress/Theme/happy-baby/vulnerability/wordpress-happy-baby-theme-1-2-12-local-file-inclusion-vulnerability.

RemediationAI

Upgrade ThemeREX Happy Baby theme to version 1.2.13 or later if available, or contact ThemeREX directly for patched release information as the Patchstack reference does not confirm a specific fix version. If immediate upgrade is not possible, implement compensating controls: disable the Happy Baby theme and switch to a maintained alternative WordPress theme until patched version is deployed. For WordPress installations that must continue using Happy Baby, restrict wp-admin access to trusted IP addresses only via .htaccess or firewall rules, reducing attack surface for theme-level vulnerabilities. Review PHP configuration to ensure allow_url_include is disabled (should be off by default in PHP 5.2.0+) to prevent remote file inclusion escalation. Monitor web server logs for suspicious requests containing path traversal patterns (../, %2e%2e/, etc.) targeting theme directories. Note that these mitigations do not eliminate the vulnerability and may impact legitimate theme functionality - upgrading remains the only complete remediation.