What is the CVSS score of CVE-2026-28079?

CVE-2026-28079 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Conquerors WordPress Theme are affected by CVE-2026-28079?

The Conquerors WordPress theme version 1.2.13 and earlier contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected servers,…

How to fix or mitigate CVE-2026-28079?

Within 24 hours: Identify all WordPress instances running Conquerors theme versions 1.2.13 or earlier via admin dashboard or plugin/theme scanner. Within 7 days: Deactivate and remove Conquerors theme 1.2.13 and earlier; migrate to an alternative maintained WordPress theme or a patched version if vendor releases one. Within 30 days: Audit file access logs for unauthorized file read attempts; rotate any credentials stored in configuration files (wp-config.php, database credentials, API keys).

Conquerors WordPress Theme CVE-2026-28079

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Conquerors conquerors allows PHP Local File Inclusion.This issue affects Conquerors: from n/a through <= 1.2.13.

AnalysisAI

Local File Inclusion in Conquerors WordPress theme 1.2.13 and earlier enables remote attackers to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, and sensitive data. Despite a CVSS score of 8.1, EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation or public POC at time of analysis. However, the network-accessible attack vector with no authentication requirement makes this a priority for sites running the affected theme.

Technical ContextAI

This is a PHP Remote/Local File Inclusion vulnerability (CWE-98) in the axiomthemes Conquerors WordPress theme. The flaw occurs when user-controlled input is passed to PHP include/require statements without proper sanitization, allowing manipulation of file paths. While the description mentions 'PHP Remote File Inclusion', the CVE title and tags indicate this is specifically a Local File Inclusion (LFI) variant, meaning attackers can read files from the server's local filesystem rather than including remote URLs. This vulnerability class is common in WordPress themes that dynamically load template files or handle file paths in AJAX handlers. The affected product is identified as a WordPress theme package, specifically version 1.2.13 and earlier releases.

Affected ProductsAI

Axiomthemes Conquerors WordPress theme versions 1.2.13 and all earlier versions are confirmed vulnerable per Patchstack advisory. The vulnerability affects the core theme code responsible for handling file inclusion operations. Organizations can verify exposure by checking their WordPress installation's wp-content/themes/conquerors directory and confirming the installed version number in the theme's style.css header. The Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/conquerors/vulnerability/wordpress-conquerors-theme-1-2-13-local-file-inclusion-vulnerability provides detailed affected version information.

RemediationAI

Immediately upgrade the Conquerors theme to a patched version newer than 1.2.13 if available from the theme vendor. Consult the official axiomthemes website or WordPress theme repository for the latest secure release. According to Patchstack reporting (https://patchstack.com/database/Wordpress/Theme/conquerors/vulnerability/wordpress-conquerors-theme-1-2-13-local-file-inclusion-vulnerability), a fix should be available from the vendor. If no patch is released or upgrade is not immediately feasible, implement these compensating controls: disable the Conquerors theme entirely and switch to a different WordPress theme until patching is complete; restrict direct access to theme PHP files via web application firewall (WAF) rules blocking suspicious file path parameters (e.g., requests containing '../', 'php://', or absolute paths); enable PHP open_basedir restrictions in server configuration to limit file access to the WordPress installation directory only (note: this may break plugins or themes that legitimately access parent directories); monitor web server access logs for POST/GET parameters containing file path traversal sequences. These mitigations reduce but do not eliminate risk, as sophisticated attackers may bypass basic filters.