What is the CVSS score of CVE-2026-28088?

CVE-2026-28088 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ThemeREX Aqualots are affected by CVE-2026-28088?

ThemeREX Aqualots WordPress theme versions up to 1.1.6 contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated remote attackers to read sensitive files or execute…

How to fix or mitigate CVE-2026-28088?

Within 24 hours: Identify all WordPress installations using ThemeREX Aqualots theme and document current version numbers. Within 7 days: Disable or remove the vulnerable theme; if functionality is required, contact ThemeREX for security guidance or migrate to an alternative theme. Within 30 days: Implement Web Application Firewall (WAF) rules to block LFI patterns targeting theme files, conduct file integrity monitoring on wp-config.php and other sensitive configuration files, and establish a vulnerability tracking process for third-party theme dependencies.

ThemeREX Aqualots CVE-2026-28088

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Aqualots aqualots allows PHP Local File Inclusion.This issue affects Aqualots: from n/a through <= 1.1.6.

AnalysisAI

Local file inclusion vulnerability in ThemeREX Aqualots WordPress theme versions up to 1.1.6 enables remote attackers to include arbitrary PHP files on the server without authentication. Despite the description's mention of 'remote file inclusion', the CVE is classified as CWE-98 (PHP Local File Inclusion) and tagged as LFI by Patchstack, indicating attackers can read sensitive files or execute local PHP code. EPSS exploitation probability is low (0.15%, 36th percentile) with no evidence of active exploitation or public POCs, though the high-complexity network attack vector suggests targeted exploitation scenarios.

Technical ContextAI

This vulnerability stems from improper sanitization of user-controlled input used in PHP include/require statements (CWE-98). The Aqualots WordPress theme fails to validate file paths before passing them to PHP file inclusion functions, allowing path traversal sequences. While the CVE description mentions 'Remote File Inclusion,' the CWE classification and Patchstack tagging indicate this is a Local File Inclusion (LFI) vulnerability. In WordPress themes, this typically occurs when dynamic template loading or file inclusion mechanisms trust user input from GET/POST parameters or HTTP headers. Successful exploitation allows reading arbitrary files within the web server's filesystem context (wp-config.php, /etc/passwd) or executing existing PHP files with attacker-controlled parameters, potentially leading to code execution if combined with file upload or log poisoning techniques.

Affected ProductsAI

ThemeREX Aqualots WordPress theme versions 1.1.6 and earlier are confirmed vulnerable per Patchstack database. The vulnerability affects all installations where the theme is active, regardless of WordPress version. Specific CPE designation was not provided in available data, though the product is definitively identified as a WordPress theme component. Complete vendor advisory and affected version enumeration are available at the Patchstack reference link provided by the NVD listing.

RemediationAI

Upgrade to Aqualots theme version 1.1.7 or later if available, though the exact patched version is not confirmed in the provided data sources. Consult the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/aqualots/vulnerability/wordpress-aqualots-theme-1-1-6-local-file-inclusion-vulnerability for vendor-specific remediation guidance and confirmed fix version. If patching is not immediately feasible, implement compensating controls: disable the Aqualots theme and switch to a maintained alternative theme until updates are verified, as WordPress allows theme switching without data loss. For sites requiring continued Aqualots operation, implement Web Application Firewall rules to block path traversal patterns ('../', encoded variants) in all user-supplied input, though this may break legitimate theme functionality requiring file path parameters. Monitor web server logs for suspicious requests containing traversal sequences or unusual file paths targeting theme directories. Note that WAF-based mitigation reduces but does not eliminate risk, as sophisticated attackers may bypass pattern matching.