What is the CVSS score of CVE-2026-28067?

CVE-2026-28067 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bassein theme are affected by CVE-2026-28067?

ThemeREX Bassein WordPress theme versions up to 1.0.15 contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated remote attackers to execute arbitrary PHP code on affected…

How to fix or mitigate CVE-2026-28067?

Within 24 hours: Inventory all WordPress installations using ThemeREX Bassein theme and document current version numbers. Within 7 days: Contact ThemeREX for patch availability status and timeline; if unavailable, disable or replace the theme with a patched alternative, or implement Web Application Firewall rules to block suspicious file inclusion patterns (e.g., requests with PHP file paths in parameters). Within 30 days: Complete theme replacement or receive vendor patch confirmation; validate remediation across all affected WordPress instances.

Bassein theme CVE-2026-28067

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bassein bassein allows PHP Local File Inclusion.This issue affects Bassein: from n/a through <= 1.0.15.

AnalysisAI

Local File Inclusion vulnerability in ThemeREX Bassein WordPress theme versions up to 1.0.15 allows remote unauthenticated attackers to include and execute arbitrary PHP files on the server via improper filename handling. Despite CVSS 8.1 High severity, EPSS exploitation probability is only 0.15% (36th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis. Patchstack advisory indicates this is a PHP file inclusion flaw affecting theme installations.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP file inclusion. The Bassein WordPress theme fails to properly validate or sanitize user-supplied input used in PHP include/require statements, allowing attackers to manipulate file paths. Despite the CVE title mentioning 'PHP Remote File Inclusion', the description and Patchstack categorization explicitly identify this as Local File Inclusion (LFI). In LFI attacks, attackers reference files already present on the server's filesystem rather than external URLs. The vulnerability exists in ThemeREX Bassein theme for WordPress, affecting all versions through 1.0.15. WordPress themes run with the privileges of the web server process, making successful exploitation particularly impactful as it can expose sensitive configuration files, session data, or achieve remote code execution by including uploaded files or log files containing attacker-controlled data.

Affected ProductsAI

ThemeREX Bassein WordPress theme versions from initial release through 1.0.15 are confirmed vulnerable. This affects WordPress installations where the Bassein theme is actively installed, regardless of whether it is the currently active theme, as vulnerable theme files remain accessible. The advisory from Patchstack (https://patchstack.com/database/Wordpress/Theme/bassein/vulnerability/wordpress-bassein-theme-1-0-15-local-file-inclusion-vulnerability) provides vulnerability confirmation. No CPE identifier is available in the provided data, suggesting limited tracking in enterprise vulnerability databases. Organizations should inventory WordPress installations and check for Bassein theme presence in wp-content/themes/ directory.

RemediationAI

Upgrade ThemeREX Bassein theme to version 1.0.16 or later if available from the theme vendor. Check the official ThemeREX website or WordPress theme repository for the latest patched version. If an updated version is not yet released or upgrade is not immediately feasible, implement the following compensating controls: (1) Deactivate and delete the Bassein theme if not actively in use - inactive themes remain exploitable. (2) Implement Web Application Firewall (WAF) rules to block common LFI attack patterns in HTTP requests, specifically targeting path traversal sequences (../, %2e%2e%2f) and sensitive file references (/etc/passwd, wp-config.php), though this may cause false positives with legitimate file upload functionality. (3) Restrict web server file system permissions using PHP open_basedir directive to prevent access outside WordPress installation directory, though this may break plugins expecting broader filesystem access. (4) Enable PHP disable_functions in php.ini to restrict dangerous functions like include, require, include_once, require_once if application compatibility permits, though this will likely break WordPress core functionality. Refer to Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/bassein/vulnerability/wordpress-bassein-theme-1-0-15-local-file-inclusion-vulnerability for technical details.