What is the CVSS score of CVE-2026-28064?

CVE-2026-28064 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Edge Decor are affected by CVE-2026-28064?

ThemeREX Edge Decor WordPress theme versions through 2.2 contain a local file inclusion vulnerability that could allow attackers to read sensitive server files and execute malicious code, affecting…

How to fix or mitigate CVE-2026-28064?

Within 24 hours: Identify all WordPress instances using ThemeREX Edge Decor theme and document affected versions. Within 7 days: Implement Web Application Firewall (WAF) rules to block requests containing file inclusion patterns (e.g., ../../../etc/passwd) and restrict PHP include/require function usage where possible; consider disabling the theme on non-critical sites. Within 30 days: Contact ThemeREX for patch availability, evaluate alternative themes, or upgrade to a patched version if released.

Edge Decor CVE-2026-28064

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Edge Decor edge-decor allows PHP Local File Inclusion.This issue affects Edge Decor: from n/a through <= 2.2.

AnalysisAI

Local file inclusion in ThemeREX Edge Decor WordPress theme through version 2.2 allows remote attackers to read arbitrary files on the server and potentially execute code via improper control of PHP include/require statements. Despite a CVSS score of 8.1, real-world exploitation risk appears moderate with EPSS at 0.15% (36th percentile) and no evidence of active exploitation or public POC. Attack complexity is rated high (AC:H), suggesting exploitation requires specific conditions beyond default configuration.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP file inclusion. The Edge Decor WordPress theme by ThemeREX fails to properly sanitize user-controlled input before passing it to PHP include() or require() functions. While the CVE description categorizes this as 'PHP Remote File Inclusion', tags and technical indicators point to Local File Inclusion (LFI), meaning attackers leverage existing files on the server rather than hosting malicious code externally. LFI in WordPress themes typically exploits template loading mechanisms, AJAX handlers, or dynamic file path construction. Successful exploitation enables reading sensitive files (wp-config.php, /etc/passwd) and potentially achieving remote code execution by including uploaded files, log files containing attacker-controlled data, or PHP session files.

Affected ProductsAI

ThemeREX Edge Decor WordPress theme versions from earliest release through 2.2 are vulnerable. The CPE identifier and specific version range data are not provided in available sources. Sites running Edge Decor as their active WordPress theme are affected. The vulnerability was reported by Patchstack's audit team, and detailed information is available in the Patchstack database at https://patchstack.com/database/Wordpress/Theme/edge-decor/vulnerability/wordpress-edge-decor-theme-2-2-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Edge Decor theme to version 2.2.1 or later if available from ThemeREX. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/edge-decor/vulnerability/wordpress-edge-decor-theme-2-2-local-file-inclusion-vulnerability for vendor-specific guidance and confirmed fix version. If no patched version is released, implement these compensating controls: disable the Edge Decor theme and switch to a maintained alternative theme; if Edge Decor must remain active, implement web application firewall (WAF) rules to block requests containing path traversal sequences (../, %2e%2e%2f) and null byte injection (%00) in URL parameters and POST data targeting the theme directory; restrict PHP's open_basedir directive to WordPress installation paths only, preventing access to system files outside the web root; enable PHP disable_functions for dangerous functions like include, require, include_once, require_once when possible (note: this may break legitimate theme functionality). Monitor WordPress access logs for suspicious requests to /wp-content/themes/edge-decor/ with unusual query parameters. Each mitigation trades functionality for security - WAF rules may cause false positives on legitimate file uploads, and open_basedir restrictions may break plugins relying on broader filesystem access.