What is the CVSS score of CVE-2026-28065?

CVE-2026-28065 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-28065?

ThemeREX Eject WordPress theme versions up to 2.17 contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary server files or execute PHP code,…

How to fix or mitigate CVE-2026-28065?

Within 24 hours: Identify all WordPress installations using ThemeREX Eject theme and document current versions via wp-cli or admin dashboard. Within 7 days: Update ThemeREX Eject theme to version 2.18 or later if available from vendor, or immediately deactivate and remove the theme if no patched version exists. Conduct file integrity scan of wp-content/themes/eject directory for unauthorized modifications. Within 30 days: Implement Web Application Firewall (WAF) rules to block PHP file inclusion patterns; audit server logs (wp-admin, wp-json endpoints) for exploitation attempts using patterns matching ../ path traversal or include/require parameter abuse.

PHP CVE-2026-28065

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Eject eject allows PHP Local File Inclusion.This issue affects Eject: from n/a through <= 2.17.

AnalysisAI

Local file inclusion in ThemeREX Eject WordPress theme versions up to 2.17 enables remote attackers to read arbitrary files on the server or execute PHP code without authentication. Despite high CVSS 8.1 severity, EPSS exploitation probability remains low at 0.15% (36th percentile) with no confirmed active exploitation. Patchstack security audit identified the vulnerability as a PHP file inclusion flaw allowing information disclosure through improper filename control in include/require statements.