What is the CVSS score of CVE-2026-28084?

CVE-2026-28084 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bazinga Theme are affected by CVE-2026-28084?

ThemeREX Bazinga WordPress theme (versions 1.1.9 and earlier) contains a local file inclusion vulnerability that could allow unauthenticated attackers to execute arbitrary PHP code or expose…

How to fix or mitigate CVE-2026-28084?

Within 24 hours: Identify all WordPress sites using ThemeREX Bazinga theme and document version numbers via admin dashboard or WP CLI. Within 7 days: Immediately deactivate and remove ThemeREX Bazinga theme from all installations; migrate to an alternative maintained WordPress theme. Within 30 days: Review access logs for suspicious file inclusion attempts (patterns like '?file=../wp-config.php'); audit for unauthorized file access or code execution artifacts in WordPress logs and database.

Bazinga Theme CVE-2026-28084

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bazinga bazinga allows PHP Local File Inclusion.This issue affects Bazinga: from n/a through <= 1.1.9.

AnalysisAI

PHP Local File Inclusion in ThemeREX Bazinga theme for WordPress (versions ≤1.1.9) allows remote unauthenticated attackers to include and execute arbitrary local files via improper filename control in require/include statements. Despite high CVSS 8.1 severity, EPSS exploitation probability is low (0.15%, 36th percentile), and no active exploitation or public POC has been identified at time of analysis. Patchstack database reports this as both a local file inclusion vector and potential information disclosure issue, suggesting exploitation could lead to code execution through PHP file inclusion or exposure of sensitive configuration data.

Technical ContextAI

The vulnerability stems from CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. WordPress themes built with PHP frequently use dynamic include() or require() statements to load template files or modules. When user-controllable input (such as GET/POST parameters, cookies, or HTTP headers) is passed directly or insufficiently sanitized into these functions, attackers can manipulate the filename to include arbitrary local files. Despite being categorized by Patchstack as 'PHP Remote File Inclusion' in the title, the CVE description specifies PHP Local File Inclusion (LFI), which is consistent with CWE-98. In LFI attacks against WordPress themes, attackers typically target files like wp-config.php to extract database credentials, /etc/passwd for reconnaissance, or upload PHP files that are then included to achieve remote code execution. The Bazinga theme by ThemeREX appears to lack proper input validation or path sanitization when handling file inclusion operations, allowing directory traversal sequences (../) or absolute paths to access files outside the intended theme directory.

Affected ProductsAI

ThemeREX Bazinga theme for WordPress, all versions up to and including 1.1.9, are vulnerable. The vulnerability resides in the theme itself rather than a plugin dependency. Sites running WordPress with the Bazinga theme installed and active are at risk. According to Patchstack database (referenced in NVD), versions from an unspecified starting point through 1.1.9 contain the vulnerable code. No CPE string was provided in the available data, and the exact WordPress version compatibility range is not specified in the references. The vendor advisory URL points to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/bazinga/vulnerability/wordpress-bazinga-theme-1-1-9-local-file-inclusion-vulnerability.

RemediationAI

Upgrade ThemeREX Bazinga theme to a version newer than 1.1.9 if available from the vendor. Check the official ThemeREX website or ThemeForest marketplace for updated releases addressing CVE-2026-28084. Review the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/bazinga/vulnerability/wordpress-bazinga-theme-1-1-9-local-file-inclusion-vulnerability for vendor-specific remediation guidance and confirmed patch versions. If no patched version is available or upgrade is not immediately feasible, implement these compensating controls: (1) Disable the Bazinga theme and switch to a maintained alternative WordPress theme, eliminating the vulnerable code entirely with no functionality trade-off if the theme is non-essential; (2) Implement Web Application Firewall (WAF) rules to block common LFI attack patterns including directory traversal sequences (../, ..\ , %2e%2e%2f), null bytes (%00), and absolute path references in URL parameters and POST data, though this may break legitimate theme functionality that uses dynamic file paths; (3) Restrict PHP execution to only approved directories using open_basedir directive in php.ini to limit file inclusion to the theme directory, which prevents access to sensitive system files but may break plugins or themes expecting broader filesystem access; (4) Enable PHP disable_functions for dangerous functions if theme functionality allows, though this is rarely practical for WordPress environments. Given the theme's apparent abandonment (version 1.1.9 with no confirmed successor), migration to an actively maintained theme is the most sustainable solution.