What is the CVSS score of CVE-2026-28085?

CVE-2026-28085 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Mahogany theme are affected by CVE-2026-28085?

ThemeREX Mahogany WordPress theme versions through 2.9 contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated attackers to read arbitrary files from affected web servers.

How to fix or mitigate CVE-2026-28085?

Within 24 hours: Identify all WordPress installations using ThemeREX Mahogany theme and verify installed version; deactivate and disable the theme immediately on all affected sites. Within 7 days: Replace the theme with a patched alternative (e.g., switch to a maintained WordPress theme from official repository); conduct file access logs review for suspicious requests to wp-content/themes/mahogany/. Within 30 days: Rotate any credentials or API keys that may have been exposed via configuration files; scan for unauthorized file access attempts in web server logs dating back 90 days.

Mahogany theme CVE-2026-28085

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Mahogany mahogany allows PHP Local File Inclusion.This issue affects Mahogany: from n/a through <= 2.9.

AnalysisAI

Local file inclusion in ThemeREX Mahogany WordPress theme versions through 2.9 enables remote unauthenticated attackers to read arbitrary files from the web server filesystem via manipulated PHP include/require statements. While classified as high-severity (CVSS 8.1), real-world exploitation risk appears moderate given the EPSS score of 0.15% (36th percentile) and high attack complexity rating. No active exploitation or public exploit code identified at time of analysis. Patchstack security audit identified and disclosed this vulnerability.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include() or require() statements within the Mahogany WordPress theme (CWE-98: PHP Remote/Local File Inclusion). Despite the CWE title referencing 'remote file inclusion', the tags and CVSS scope (S:U) indicate this is a local file inclusion issue. The theme likely accepts user-controlled input for dynamic file inclusion without proper sanitization, allowing directory traversal sequences or path manipulation. WordPress themes running on PHP servers are particularly susceptible when file paths are constructed from GET/POST parameters, cookies, or other external input sources without strict allowlisting or canonicalization.

Affected ProductsAI

ThemeREX Mahogany WordPress theme versions from earliest release through version 2.9 are confirmed vulnerable per Patchstack database. The CPE data is not provided, but the vulnerability affects WordPress installations running this commercial theme. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/mahogany/vulnerability/wordpress-mahogany-theme-2-9-local-file-inclusion-vulnerability (reference ID cve). Organizations should inventory WordPress sites and identify any using Mahogany theme version 2.9 or earlier.

RemediationAI

Upgrade the Mahogany WordPress theme to version 2.9.1 or later if available, verifying the fixed version directly with ThemeREX or via the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/mahogany/vulnerability/wordpress-mahogany-theme-2-9-local-file-inclusion-vulnerability. If an updated theme version is not immediately available, implement compensating controls: disable the Mahogany theme entirely and switch to a maintained alternative theme; configure web application firewall (WAF) rules to block requests containing directory traversal sequences (../, ..\ , %2e%2e%2f) in URL parameters and POST bodies targeting theme files; restrict PHP open_basedir directive to limit file access scope; review web server logs for suspicious file access patterns targeting wp-content/themes/mahogany/ paths. Note that WAF-based mitigations may cause false positives with legitimate file uploads or theme customization features and should be tested in staging environments first.