CVE-2026-28087
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Filmax filmax allows PHP Local File Inclusion.This issue affects Filmax: from n/a through <= 1.1.11.
Analysis
Improper input validation in ThemeREX Filmax versions up to 1.1.11 allows unauthenticated attackers to include and execute arbitrary local files through PHP include/require statements, potentially leading to remote code execution. An attacker can exploit this vulnerability over the network without user interaction to read sensitive files or execute malicious code with the privileges of the web server. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all instances of ThemeREX Filmax plugin across your environment and assess exposure. Within 7 days: Implement network-based mitigations (WAF rules blocking file inclusion patterns, disable the plugin if non-critical, or restrict access to admin interfaces). …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today