What is the CVSS score of CVE-2026-28089?

CVE-2026-28089 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Daiquiri theme are affected by CVE-2026-28089?

ThemeREX Daiquiri WordPress theme versions 1.2.4 and earlier contain a local file inclusion vulnerability that could allow attackers to read sensitive files or execute arbitrary PHP code on affected…

How to fix or mitigate CVE-2026-28089?

Within 24 hours: Identify all WordPress installations using ThemeREX Daiquiri theme and document current versions. Within 7 days: Disable or deactivate the theme on all affected sites; switch to alternative theme or update to version 1.2.5 or later if available from ThemeREX. Within 30 days: Conduct file integrity review on affected servers, check access logs for suspicious include/require patterns, and implement Web Application Firewall (WAF) rules blocking local file inclusion attempts targeting WordPress theme directories.

Daiquiri theme CVE-2026-28089

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Daiquiri daiquiri allows PHP Local File Inclusion.This issue affects Daiquiri: from n/a through <= 1.2.4.

AnalysisAI

PHP Local File Inclusion in ThemeREX Daiquiri WordPress theme versions ≤1.2.4 allows remote attackers to read arbitrary files or execute PHP code by exploiting improper filename control in include/require statements. Despite high CVSS (8.1), real-world risk is moderate: EPSS exploitation probability is low (0.15%, 36th percentile), no confirmed active exploitation exists, and attack complexity is high (AC:H). Patchstack audit identified this vulnerability, suggesting professional security review but no public exploit code at time of analysis.

Technical ContextAI

This vulnerability exploits CWE-98, improper control of filename parameters passed to PHP include/require statements in the Daiquiri WordPress theme by ThemeREX. PHP file inclusion vulnerabilities occur when user-controlled input is concatenated into file paths without proper sanitization, allowing attackers to manipulate the include path to reference arbitrary files. The CVSS vector indicates network-based exploitation (AV:N) with no authentication required (PR:N), but high attack complexity (AC:H) suggests exploitation requires specific knowledge of file paths, timing conditions, or state manipulation. The vulnerability classification references both PHP Remote File Inclusion (title) and PHP Local File Inclusion (description/tags), though the exploitation ultimately targets local file access. WordPress themes commonly introduce such flaws through custom template loading mechanisms, shortcode handlers, or AJAX endpoints that accept file path parameters.

Affected ProductsAI

ThemeREX Daiquiri WordPress theme versions through 1.2.4 are confirmed vulnerable based on Patchstack database records at https://patchstack.com/database/Wordpress/Theme/daiquiri/vulnerability/wordpress-daiquiri-theme-1-2-4-local-file-inclusion-vulnerability. All deployments running version 1.2.4 or earlier should be considered affected. No CPE identifier is provided in available data. The vulnerability affects the core theme code handling file inclusion operations, likely in template loading or feature initialization routines. WordPress installations using this theme with default or custom configurations are at risk.

RemediationAI

Upgrade Daiquiri theme to version 1.2.5 or later if available - verify current patched version status with ThemeREX vendor advisory or WordPress theme repository. Until patch deployment, implement compensating controls: disable the Daiquiri theme and switch to a trusted alternative WordPress theme if business operations permit (zero residual risk but requires content/layout adjustment). If theme must remain active, restrict WordPress admin access to trusted IP addresses via .htaccess or web application firewall rules to limit attack surface (reduces remote exploitation risk but does not eliminate vulnerability for authenticated users). Review theme configuration for any file path parameters exposed through shortcodes or custom endpoints and disable non-essential features. Enable WordPress file modification logging to detect exploitation attempts. Consult Patchstack advisory at provided URL for specific affected code paths and additional vendor guidance. Note that file inclusion vulnerabilities cannot be fully mitigated without code-level fixes - compensating controls only reduce exposure.