What is the CVSS score of CVE-2026-28077?

CVE-2026-28077 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Vapester WordPress Theme are affected by CVE-2026-28077?

ThemeREX Vapester WordPress theme versions 1.1.10 and earlier contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web…

How to fix or mitigate CVE-2026-28077?

Within 24 hours: Audit all WordPress installations for ThemeREX Vapester theme presence and document affected versions; disable or remove the theme on production systems. Within 7 days: Either update to Vapester version 1.1.11 or later if released, or implement a WordPress security plugin (e.g., Wordfence) with file access controls; restrict direct file access via web server configuration. Within 30 days: Rotate all credentials stored in or accessible via web-accessible configuration files; conduct log review for evidence of exploitation attempts targeting file inclusion patterns (e.g., requests containing '../' or sensitive file paths).

Vapester WordPress Theme CVE-2026-28077

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Vapester vapester allows PHP Local File Inclusion.This issue affects Vapester: from n/a through <= 1.1.10.

AnalysisAI

Local file inclusion in ThemeREX Vapester WordPress theme versions ≤1.1.10 allows remote unauthenticated attackers to read arbitrary files from the web server, potentially exposing configuration files, credentials, and sensitive application data. Despite high CVSS score of 8.1, EPSS probability of 0.15% (36th percentile) suggests limited observed exploitation attempts. No active exploitation confirmed by CISA KEV, though Patchstack database listing indicates vulnerability is known to security researchers.

Technical ContextAI

The vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98). When user-controlled input influences file inclusion operations without adequate sanitization, attackers can manipulate path traversal sequences or specify arbitrary local files. WordPress themes commonly use dynamic file inclusion for template loading and localization. The CVSS vector indicates network-based attack (AV:N) with high complexity (AC:H), suggesting exploitation requires specific conditions like particular PHP configurations or vulnerable code paths. The CWE classification as 'PHP Remote File Inclusion' in the description appears inconsistent with the 'PHP Local File Inclusion' determination and LFI tag, indicating the vulnerability allows reading local files rather than including remote resources.

Affected ProductsAI

ThemeREX Vapester WordPress theme versions 1.1.10 and earlier are affected by this local file inclusion vulnerability. The vulnerability report from Patchstack (https://patchstack.com/database/Wordpress/Theme/vapester/vulnerability/wordpress-vapester-theme-1-1-10-local-file-inclusion-vulnerability?_s_id=cve) indicates all versions up to and including 1.1.10 contain the flaw. No specific CPE identifier was provided in available data. WordPress sites using Vapester theme in any deployment configuration are potentially vulnerable regardless of hosting environment.

RemediationAI

Upgrade ThemeREX Vapester theme to version 1.1.11 or later if available, though patch version is not independently confirmed in provided data sources. Consult ThemeREX vendor directly or monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vapester/vulnerability/wordpress-vapester-theme-1-1-10-local-file-inclusion-vulnerability?_s_id=cve for official patch release confirmation. If patched version is unavailable or upgrade is not immediately feasible, implement compensating controls: disable the Vapester theme entirely and switch to a maintained alternative theme until fix is confirmed; implement web application firewall rules to block requests containing path traversal sequences (../, .\, %2e%2e%2f) in parameters to theme files, noting this may break legitimate functionality requiring path-based navigation; restrict PHP file access permissions to prevent reading of sensitive configuration files outside the web root; enable PHP open_basedir directive to limit file system access to WordPress installation directory only, though this may impact plugins requiring broader file access. Monitor web server access logs for suspicious requests to theme files with unusual parameters.