What is the CVSS score of CVE-2026-28069?

CVE-2026-28069 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Le Truffe WordPress Theme are affected by CVE-2026-28069?

ThemeREX Le Truffe WordPress theme versions up to 1.1.7 contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2026-28069?

Within 24 hours: Identify all WordPress installations using ThemeREX Le Truffe theme version 1.1.7 or earlier via inventory or plugin audit tools. Within 7 days: Disable or remove the vulnerable theme if actively used; if removal is not feasible, implement Web Application Firewall rules to block requests containing path traversal patterns (e.g., '../', '..\', URL-encoded variants) targeting the theme directory. Contact theme vendor to confirm patch timeline or plan theme replacement. Within 30 days: Migrate to an alternative, actively maintained WordPress theme and verify sensitive files (wp-config.php, .env, database backups) are not accessible via web root directory traversal.

Le Truffe WordPress Theme CVE-2026-28069

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Le Truffe letruffe allows PHP Local File Inclusion.This issue affects Le Truffe: from n/a through <= 1.1.7.

AnalysisAI

Local file inclusion in ThemeREX Le Truffe WordPress theme versions up to 1.1.7 enables remote attackers to read arbitrary files from the web server without authentication. While CVSS scores 8.1 (High), EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation. The vulnerability stems from improper filename control in PHP include/require statements, allowing path traversal to access sensitive server files. No public exploit code identified at time of analysis.

Technical ContextAI

This is a CWE-98 (PHP Remote File Inclusion) vulnerability affecting the Le Truffe WordPress theme by ThemeREX. Despite the CWE classification suggesting RFI, the CVE description and Patchstack categorization both identify this as Local File Inclusion (LFI). LFI vulnerabilities occur when PHP include() or require() statements accept unsanitized user input for file paths, allowing attackers to traverse directory structures using sequences like '../' to read arbitrary files outside the intended web root. Common targets include /etc/passwd, wp-config.php (exposing database credentials), or other configuration files containing secrets. The discrepancy between CWE-98 (RFI) and actual LFI classification suggests the vulnerable code may accept both local and remote file paths, or the CWE assignment is inaccurate.

Affected ProductsAI

ThemeREX Le Truffe WordPress theme versions from earliest release through 1.1.7 are confirmed vulnerable per Patchstack advisory. The vulnerability affects all installations of the theme regardless of WordPress version, though specific PHP version requirements are not documented. Full advisory available at https://patchstack.com/database/Wordpress/Theme/letruffe/vulnerability/wordpress-le-truffe-theme-1-1-7-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Le Truffe theme to version 1.1.8 or later if available, verifying the specific patched version through ThemeREX official channels or the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/letruffe/vulnerability/wordpress-le-truffe-theme-1-1-7-local-file-inclusion-vulnerability. If no patch exists or immediate upgrade is not feasible, implement compensating controls: (1) Disable or deactivate the Le Truffe theme and switch to a maintained alternative theme, ensuring complete theme removal rather than just deactivation to prevent exploitation through direct file access. (2) Apply web application firewall (WAF) rules to block requests containing path traversal sequences (../, %2e%2e%2f, etc.) to theme directory endpoints, though sophisticated attackers may bypass pattern-based filters using encoding tricks. (3) Enforce PHP open_basedir restrictions in php.ini or .htaccess to limit file access to WordPress installation directories only, preventing traversal to /etc/ and other system paths, though this may break legitimate theme functionality requiring broader file access. (4) Monitor web server logs for suspicious requests to theme files containing traversal patterns or accessing unexpected file extensions.