What is the CVSS score of CVE-2026-28087?

CVE-2026-28087 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Filmax theme are affected by CVE-2026-28087?

CVE-2026-28087 is a local file inclusion vulnerability in ThemeREX Filmax WordPress theme (versions ≤1.1.11) that allows remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2026-28087?

Within 24 hours: audit all active WordPress installations for ThemeREX Filmax theme presence and disable/deactivate the theme immediately. Within 7 days: replace the affected theme with a patched alternative (e.g., update to a non-vulnerable WordPress theme from the official repository) and verify no residual theme files remain. Within 30 days: conduct file access logs review for CVE-2026-28087 exploitation indicators and rotate any credentials stored in web-accessible configuration files.

Filmax theme CVE-2026-28087

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Filmax filmax allows PHP Local File Inclusion.This issue affects Filmax: from n/a through <= 1.1.11.

AnalysisAI

Local file inclusion in ThemeREX Filmax WordPress theme versions ≤1.1.11 enables remote attackers to read arbitrary files from the web server and potentially execute malicious code. The vulnerability stems from improper filename validation in PHP include/require statements, categorized as CWE-98. Despite a CVSS score of 8.1, EPSS probability is low (0.15%, 36th percentile), suggesting targeted rather than widespread exploitation. Patchstack database identifies this as affecting information disclosure through LFI techniques, with no confirmed active exploitation or KEV listing at time of analysis.

Technical ContextAI

This vulnerability exploits improper control of filename parameters passed to PHP's include() or require() functions within the Filmax WordPress theme. CWE-98 (PHP Remote File Inclusion) encompasses both remote and local file inclusion attacks where user-controlled input manipulates file path arguments without proper sanitization. Despite the CWE name, Patchstack tags confirm this as LFI (Local File Inclusion). WordPress themes commonly use dynamic file inclusion for template loading, but when user input directly influences these paths without validation (allowlisting, path traversal prevention, or null-byte filtering), attackers can traverse directories (../../../etc/passwd) or include log files containing injected PHP code. The affected component is the ThemeREX Filmax theme through version 1.1.11, a WordPress frontend design framework.

Affected ProductsAI

ThemeREX Filmax WordPress theme versions from earliest release through version 1.1.11 are confirmed vulnerable per Patchstack database (https://patchstack.com/database/Wordpress/Theme/filmax/vulnerability/wordpress-filmax-theme-1-1-11-local-file-inclusion-vulnerability). The vulnerability affects WordPress installations where Filmax theme is active. CPE data not provided in NVD reference, indicating possible limited distribution or niche deployment of this theme. No other ThemeREX products mentioned in available intelligence, suggesting vulnerability is isolated to Filmax theme codebase.

RemediationAI

Upgrade ThemeREX Filmax theme to version 1.1.12 or later if available, as Patchstack advisory reference uses '<= 1.1.11' notation implying a fix exists in subsequent releases. Verify patched version availability directly with ThemeREX or through WordPress theme repository. If immediate upgrade is not feasible, implement compensating controls: (1) Switch to a different WordPress theme temporarily, accepting design/functionality changes as trade-off; (2) Restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, reducing attack surface but not addressing the root cause; (3) Deploy Web Application Firewall rules to block path traversal patterns (../, %2e%2e%2f, null bytes) in HTTP requests to theme endpoints, noting this may cause false positives for legitimate file operations; (4) Enable PHP open_basedir restrictions to confine file access to WordPress installation directory, which may break plugins expecting broader filesystem access. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/filmax/vulnerability/wordpress-filmax-theme-1-1-11-local-file-inclusion-vulnerability for additional vendor-specific guidance.