What is the CVSS score of CVE-2026-28068?

CVE-2026-28068 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Rhythmo Theme are affected by CVE-2026-28068?

ThemeREX Rhythmo WordPress theme versions through 1.3.4 contain a local file inclusion vulnerability allowing unauthenticated remote attackers to read arbitrary server files and potentially execute…

How to fix or mitigate CVE-2026-28068?

Within 24 hours: Identify all WordPress installations using ThemeREX Rhythmo theme and document current versions. Within 7 days: Disable or remove the affected theme if version 1.3.4 or earlier is in use; if the theme is essential, implement Web Application Firewall (WAF) rules to block file inclusion patterns and restrict access to sensitive file paths. Within 30 days: Monitor the ThemeREX advisory page for patch release; upgrade to patched version immediately upon availability. For WordPress sites, enable security headers (X-Frame-Options, Content-Security-Policy) and conduct file access log review for exploitation attempts.

Rhythmo Theme CVE-2026-28068

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:42 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Rhythmo rhythmo allows PHP Local File Inclusion.This issue affects Rhythmo: from n/a through <= 1.3.4.

AnalysisAI

Local File Inclusion in ThemeREX Rhythmo WordPress theme through version 1.3.4 allows remote unauthenticated attackers to read arbitrary files on the server and potentially achieve remote code execution through log file poisoning or PHP wrapper exploitation. Despite network attack vector (AV:N) and high impact ratings (C:H/I:H/A:H), EPSS probability remains low at 0.15%, and no active exploitation has been confirmed in CISA KEV. Attack complexity is rated HIGH (AC:H), indicating specific conditions or timing required for successful exploitation.

Technical ContextAI

CWE-98 identifies improper control of include/require statements in PHP applications. The Rhythmo theme (a WordPress theme by ThemeREX) fails to properly validate or sanitize user-supplied input used in PHP file inclusion functions like include(), require(), include_once(), or require_once(). While the CVE classification mentions 'PHP Remote File Inclusion' in the title, the vulnerability name and tags specifically identify this as Local File Inclusion (LFI). LFI vulnerabilities allow attackers to reference files already on the server using path traversal sequences (../) or absolute paths, whereas RFI requires allow_url_include to be enabled in PHP configuration. This discrepancy between the CVE description title and actual vulnerability type is significant for exploitation assessment. WordPress themes commonly implement dynamic file inclusion for template loading, which when improperly secured creates attack surface for file inclusion vulnerabilities.

Affected ProductsAI

ThemeREX Rhythmo WordPress theme versions from earliest release through version 1.3.4 inclusive. No CPE string provided in source data. Vulnerability reported by Patchstack audit team with detailed advisory at https://patchstack.com/database/Wordpress/Theme/rhythmo/vulnerability/wordpress-rhythmo-theme-1-3-4-local-file-inclusion-vulnerability. Affects only WordPress installations with Rhythmo theme actively installed and enabled, not WordPress core or other themes.

RemediationAI

Upgrade Rhythmo theme to version 1.3.5 or later if available from ThemeREX (fix version not confirmed in provided data - verify with vendor before deployment). As interim mitigation pending patch availability, disable the Rhythmo theme and switch to a different WordPress theme if not business-critical. Implement web application firewall (WAF) rules to block common LFI patterns in HTTP parameters (../, absolute paths like /etc/, PHP wrappers like php://filter) with awareness this may break legitimate theme functionality. Restrict PHP allow_url_include directive to 'Off' in php.ini to prevent escalation to remote file inclusion, though this is default in modern PHP versions. Review web server logs for suspicious file access patterns including path traversal attempts. Complete advisory and technical details available at Patchstack database URL provided in references. Note that switching themes may affect site appearance and require reconfiguration of theme-specific settings.