What is the CVSS score of CVE-2026-28086?

CVE-2026-28086 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Run Gran WordPress Theme are affected by CVE-2026-28086?

CVE-2026-28086 is a local file inclusion vulnerability in ThemeREX Run Gran WordPress theme (versions through 2.0) that enables remote attackers to read arbitrary files from affected web servers.

How to fix or mitigate CVE-2026-28086?

Within 24 hours: Identify all WordPress installations using ThemeREX Run Gran theme version 2.0 or earlier and disable the theme or restrict theme file access via web server rules. Within 7 days: Upgrade to a patched version if released by vendor, or migrate to an alternative WordPress theme with active security maintenance. Within 30 days: Conduct file access audit on affected servers and review logs for suspicious include statements or file read attempts.

Run Gran WordPress Theme CVE-2026-28086

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Run Gran run-gran allows PHP Local File Inclusion.This issue affects Run Gran: from n/a through <= 2.0.

AnalysisAI

Local file inclusion vulnerability in ThemeREX Run Gran WordPress theme versions through 2.0 allows remote attackers to read arbitrary files from the web server filesystem via crafted PHP include statements. Despite the moderate EPSS score (0.15%, 36th percentile), the high-complexity attack vector suggests exploitation requires specific knowledge of file paths or application structure. No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept code identified at time of analysis. Patchstack has documented this vulnerability, indicating awareness within the WordPress security community.

Technical ContextAI

This vulnerability stems from CWE-98, improper control of filename parameters passed to PHP include() or require() functions. While classified as 'PHP Remote File Inclusion' in the description, tags and references indicate this is actually a Local File Inclusion (LFI) issue, meaning attackers can force the application to include existing files from the local server filesystem rather than remote URLs. The Run Gran theme likely accepts user-controllable input (via HTTP parameters) that directly influences file paths in PHP include/require statements without proper validation or sanitization. This allows path traversal sequences (../) or absolute paths to access sensitive files like configuration files, logs, or other PHP scripts outside the intended directory. The WordPress theme context suggests vulnerable code in template handling, plugin integration points, or AJAX endpoints where file paths are dynamically constructed.

Affected ProductsAI

WordPress Run Gran theme by ThemeREX, versions from initial release through 2.0 inclusive. The vulnerability affects all installations running these versions regardless of WordPress core version. CPE information not provided in available data sources. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/run-gran/vulnerability/wordpress-run-gran-theme-2-0-local-file-inclusion-vulnerability with additional technical details. No vendor security bulletin from ThemeREX identified in provided references.

RemediationAI

Upgrade Run Gran theme to version 2.1 or later if available - verify patched version directly with ThemeREX as no independently confirmed fix version exists in provided data sources. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/run-gran/vulnerability/wordpress-run-gran-theme-2-0-local-file-inclusion-vulnerability for specific remediation guidance. If immediate patching is not feasible, implement compensating controls: disable the Run Gran theme and switch to a maintained alternative until updates are available; restrict WordPress administrative access to trusted IP addresses only via .htaccess or firewall rules, reducing attacker surface for reconnaissance; enable PHP open_basedir directive to confine file operations to WordPress installation directory, preventing path traversal to sensitive system files (note: may break legitimate theme functionality requiring testing); implement Web Application Firewall (WAF) rules to detect and block common LFI patterns in HTTP parameters (../, absolute paths, null bytes) with awareness this provides defense-in-depth but determined attackers may bypass signature-based detection; monitor web server logs for suspicious file access patterns targeting configuration files. Review WordPress file permissions to ensure wp-config.php and other sensitive files are not world-readable.