What is the CVSS score of CVE-2026-28066?

CVE-2026-28066 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Legrand Theme are affected by CVE-2026-28066?

ThemeREX Legrand WordPress theme versions 2.17 and earlier contain a local file inclusion vulnerability (CVE-2026-28066) that could allow remote attackers to read sensitive server files, potentially…

How to fix or mitigate CVE-2026-28066?

Within 24 hours: inventory all WordPress installations using ThemeREX Legrand theme and document current versions. Within 7 days: disable or replace ThemeREX Legrand with an alternative theme; if replacement is not feasible, implement Web Application Firewall (WAF) rules to block suspicious file path parameters (e.g., ../../../etc/passwd patterns) and restrict PHP include/require operations to whitelisted files. Within 30 days: monitor for official vendor security updates and test patching procedures if version >2.17 becomes available.

Legrand Theme CVE-2026-28066

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through <= 2.17.

AnalysisAI

Local file inclusion in ThemeREX Legrand WordPress theme versions ≤2.17 allows remote attackers to read arbitrary files from the server filesystem through improper filename validation in PHP include/require statements. Despite high CVSS 8.1, EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation or public exploit code. Reported by Patchstack security research team, this represents a moderate real-world risk primarily for installations where attackers can control file path parameters.

Technical ContextAI

The vulnerability stems from CWE-98 (PHP Remote File Inclusion), specifically manifesting as local file inclusion due to insufficient validation of user-controlled input passed to PHP's include() or require() functions. When a WordPress theme allows external data to influence file path parameters without proper sanitization, attackers can traverse directory structures using path manipulation sequences (../). While classified as RFI in the description, the tags and CVE title indicate this is actually an LFI vulnerability where attackers read local server files rather than execute remote code. The Legrand theme, developed by ThemeREX for WordPress installations, processes file inclusion operations without adequate input filtering, enabling directory traversal attacks. The affected component likely resides in template loading, customization handlers, or AJAX endpoints that dynamically include PHP files based on user parameters.

Affected ProductsAI

ThemeREX Legrand WordPress theme versions 2.17 and earlier are confirmed vulnerable. The version range notation 'from n/a through ≤2.17' indicates all released versions up to and including 2.17 contain the file inclusion flaw. WordPress installations using this theme in any deployment mode (multisite, standard) are affected. Vendor advisory and patch details available through Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Theme/legrand/vulnerability/wordpress-legrand-theme-2-17-local-file-inclusion-vulnerability.

RemediationAI

Update ThemeREX Legrand theme to version 2.18 or later if available, verifying fix through the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/legrand/vulnerability/wordpress-legrand-theme-2-17-local-file-inclusion-vulnerability. If immediate patching is not feasible, implement specific compensating controls: restrict access to theme administrative endpoints through IP allowlisting at web server or WAF level, limiting exposure to trusted networks only; enable WordPress application firewall rules (via plugins like Wordfence, Sucuri) to block directory traversal patterns in HTTP parameters; audit theme usage and deactivate Legrand if not business-critical, switching to alternative WordPress themes; implement file access logging to detect exploitation attempts targeting sensitive configuration files. Note that deactivating the theme prevents exploitation but may break site design requiring template migration. Web application firewall rules may generate false positives for legitimate theme functionality requiring testing in staging environments before production deployment.