What is the CVSS score of CVE-2026-28081?

CVE-2026-28081 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windsor Theme are affected by CVE-2026-28081?

CVE-2026-28081 affects the ThemeREX Windsor WordPress theme through version 2.5.0, enabling remote attackers to include and execute arbitrary PHP files locally on affected servers.

How to fix or mitigate CVE-2026-28081?

Within 24 hours: Identify all WordPress installations using ThemeREX Windsor theme and document current version numbers; disable or remove the theme if not actively required. Within 7 days: Contact ThemeREX for patch availability and timelines; if unavailable, apply compensating controls (see below). Within 30 days: Upgrade to a patched version of ThemeREX Windsor when released by the vendor, or migrate to an alternative theme if the vendor does not release a security update.

Windsor Theme CVE-2026-28081

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Windsor windsor allows PHP Local File Inclusion.This issue affects Windsor: from n/a through <= 2.5.0.

AnalysisAI

Local file inclusion in the ThemeREX Windsor WordPress theme allows remote attackers to include and execute arbitrary PHP files on the server through improper filename control. Affects all versions through 2.5.0. Despite CVSS 8.1 (High), EPSS indicates low exploitation probability (0.15%, 36th percentile), suggesting limited attacker interest. No active exploitation confirmed via CISA KEV at time of analysis. Patchstack database lists this vulnerability with PHP and information disclosure tags, indicating potential for data exfiltration beyond code execution.

Technical ContextAI

This is a PHP Remote/Local File Inclusion (RFI/LFI) vulnerability classified as CWE-98, occurring when user-controlled input is passed to PHP include() or require() statements without proper validation. The Windsor theme (a WordPress theme by ThemeREX) fails to sanitize file paths, allowing attackers to manipulate include/require parameters to load arbitrary local files from the server filesystem. In WordPress themes, this commonly occurs in template loaders, AJAX handlers, or custom routing functions that dynamically construct file paths. The vulnerability enables access to configuration files (wp-config.php), log files, or /etc/passwd on Linux systems, and when combined with file upload capabilities or PHP wrappers (php://filter, php://input), can escalate to remote code execution.

Affected ProductsAI

ThemeREX Windsor WordPress theme versions from earliest release through 2.5.0 are confirmed vulnerable per Patchstack advisory. This affects WordPress installations running Windsor as either active theme or inactive-but-installed theme, as some WordPress vulnerabilities can be triggered in inactive themes through direct file access. The vulnerability was reported by audit@patchstack.com and documented in the Patchstack vulnerability database under WordPress theme category. No CPE strings were provided in source data, limiting automated asset inventory matching. Site administrators can verify affected status by checking Appearance > Themes in WordPress admin panel for Windsor theme version numbers.

RemediationAI

Update ThemeREX Windsor theme to version 2.5.1 or later if available, referencing the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/windsor/vulnerability/wordpress-windsor-theme-2-5-0-local-file-inclusion-vulnerability. If updated theme version is not yet released or update is not immediately feasible, implement these compensating controls: (1) Deactivate and delete the Windsor theme if not actively in use - WordPress can execute code in inactive themes under certain conditions. (2) Implement Web Application Firewall (WAF) rules to block requests containing directory traversal sequences (../, %2e%2e%2f) and null bytes (%00) in URL parameters targeting theme directories (/wp-content/themes/windsor/). Note this may break legitimate theme functionality if admin pages use file parameters. (3) Verify php.ini has allow_url_include=Off (default since PHP 5.2) to prevent remote file inclusion escalation, though this does not prevent local file inclusion. (4) Apply filesystem permissions limiting web server read access to sensitive files (chmod 640 on wp-config.php, restrict /etc access). Review WordPress security logs and web server access logs for suspicious requests to Windsor theme files with unusual parameters.