What is the CVSS score of CVE-2026-28063?

CVE-2026-28063 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Asia Garden theme are affected by CVE-2026-28063?

ThemeREX Asia Garden WordPress theme versions 1.3.1 and earlier contain a local file inclusion vulnerability (CVE-2026-28063) that allows unauthenticated attackers to execute arbitrary PHP code on…

How to fix or mitigate CVE-2026-28063?

Within 24 hours: Identify all WordPress installations using ThemeREX Asia Garden theme ≤1.3.1 via admin dashboard or security scanning tools. Within 7 days: Either upgrade to theme version >1.3.1 (if available from vendor) or replace with an alternative WordPress theme and revert to a known-good backup if exploitation is suspected. Within 30 days: Conduct PHP execution log review for the affected server period, audit file system for unauthorized PHP files, and implement Web Application Firewall (WAF) rules blocking LFI patterns targeting theme directories.

Asia Garden theme CVE-2026-28063

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Asia Garden asia-garden allows PHP Local File Inclusion.This issue affects Asia Garden: from n/a through <= 1.3.1.

AnalysisAI

Local file inclusion in ThemeREX Asia Garden WordPress theme (versions ≤1.3.1) allows remote attackers to include and execute arbitrary PHP files on the server. Despite a CVSS base score of 8.1 (High), the EPSS score of 0.15% (36th percentile) indicates low observed exploitation probability in the wild. The vulnerability requires high attack complexity (AC:H) but no authentication (PR:N), enabling unauthenticated remote exploitation under specific conditions. Patchstack database confirmed this LFI vulnerability affecting WordPress installations using this theme.

Technical ContextAI

This is a PHP Remote/Local File Inclusion vulnerability (CWE-98) in the Asia Garden WordPress theme by ThemeREX. The flaw stems from improper control of filename parameters in PHP include/require statements, allowing attackers to manipulate file paths. While classified as 'PHP Remote File Inclusion' in the CVE description, Patchstack tags it as LFI (Local File Inclusion), suggesting the vulnerability enables inclusion of local server files rather than remote URLs. This discrepancy may indicate the vulnerability allows both LFI and RFI depending on PHP configuration (allow_url_include setting). The affected component is a WordPress theme, which typically handles user input for template rendering, asset loading, or dynamic content inclusion without proper path sanitization or validation.

Affected ProductsAI

ThemeREX Asia Garden WordPress theme versions 1.3.1 and earlier are confirmed vulnerable. The CVE notation 'from n/a through <= 1.3.1' indicates all versions up to and including 1.3.1 are affected, though the initial vulnerable version is not documented. This affects WordPress installations using Asia Garden as their active theme. No CPE identifier was provided in the intelligence data. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/asia-garden/vulnerability/wordpress-asia-garden-theme-1-3-1-local-file-inclusion-vulnerability provides additional technical details for affected deployments.

RemediationAI

Update Asia Garden theme to version 1.3.2 or later if available (patch version number inferred from vulnerable version ≤1.3.1 but not independently verified from provided data sources). Check the ThemeREX vendor site or WordPress theme repository for the latest secure release. If no patched version exists or immediate update is not feasible, implement the following compensating controls with noted trade-offs: (1) Disable the Asia Garden theme and switch to a well-maintained alternative theme (disrupts site design but eliminates vulnerability). (2) Implement web application firewall (WAF) rules to detect and block LFI attack patterns in HTTP requests targeting theme files, specifically monitoring for directory traversal sequences (../, %2e%2e%2f) and PHP wrapper protocols (php://, file://, data://) in URL parameters (may cause false positives on legitimate requests). (3) Apply PHP hardening by setting open_basedir restrictions to limit file access scope and disable allow_url_include in php.ini (prevents RFI escalation but may break legitimate theme functionality requiring external resource inclusion). Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/asia-garden/vulnerability/wordpress-asia-garden-theme-1-3-1-local-file-inclusion-vulnerability for vendor-specific guidance.