What is the CVSS score of CVE-2026-28090?

CVE-2026-28090 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gamezone WordPress Theme are affected by CVE-2026-28090?

ThemeREX Gamezone WordPress theme (versions ≤1.1.11) contains a local file inclusion vulnerability allowing unauthenticated attackers to read arbitrary server files, potentially exposing sensitive…

How to fix or mitigate CVE-2026-28090?

Within 24 hours: Identify all WordPress installations using ThemeREX Gamezone theme and document current versions. Within 7 days: Contact ThemeREX for patch availability and timeline; implement file access restrictions via .htaccess or web application firewall rules to block suspicious path traversal patterns in the affected theme. Within 30 days: Either upgrade to a patched version once available, migrate to an alternative theme, or deploy compensating controls if upgrade is not feasible.

Gamezone WordPress Theme CVE-2026-28090

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gamezone gamezone allows PHP Local File Inclusion.This issue affects Gamezone: from n/a through <= 1.1.11.

AnalysisAI

Local file inclusion (LFI) vulnerability in ThemeREX Gamezone WordPress theme versions up to 1.1.11 allows remote unauthenticated attackers to read arbitrary files from the web server, potentially exposing configuration files, credentials, and sensitive application data. The CVSS score of 8.1 reflects high complexity exploitation requiring specific conditions, while the low EPSS score (0.15%, 36th percentile) indicates minimal observed exploitation attempts in the wild. No active exploitation confirmed by CISA KEV at time of analysis.

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), a classic web application security flaw. WordPress themes often dynamically include PHP files based on user-controlled input without proper sanitization or path validation. When attackers can manipulate file path parameters, they can traverse the filesystem using path traversal sequences (../) or null byte injection to include arbitrary local files. The affected component is ThemeREX Gamezone, a WordPress theme for gaming-related websites. While classified as 'PHP Remote File Inclusion' in the description, the CVE title and Patchstack reference specifically identify this as Local File Inclusion, meaning attackers read files from the local server rather than injecting remote PHP code. The distinction matters because LFI typically requires chaining with other vulnerabilities (like log poisoning or PHP wrappers) to achieve code execution, whereas true RFI allows direct remote code injection.

Affected ProductsAI

ThemeREX Gamezone WordPress theme versions from earliest release through version 1.1.11 are confirmed vulnerable according to NVD CVE data and Patchstack database. The theme is distributed through ThemeREX marketplace for WordPress installations. No specific WordPress core version requirements are documented, suggesting vulnerability exists across WordPress versions when the vulnerable theme version is active. Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/gamezone/vulnerability/wordpress-gamezone-theme-1-1-11-local-file-inclusion-vulnerability provides additional technical details. No CVE-assigned CPE identifier is present in provided data.

RemediationAI

Update ThemeREX Gamezone theme to version 1.1.12 or later if available from the vendor. Verify patch availability at the official ThemeREX marketplace or theme support channels, as the Patchstack reference (https://patchstack.com/database/Wordpress/Theme/gamezone/vulnerability/wordpress-gamezone-theme-1-1-11-local-file-inclusion-vulnerability) confirms the vulnerability scope but provided data does not include independently verified patch release details. If immediate patching is not possible, implement these compensating controls with noted trade-offs: (1) Disable the Gamezone theme and switch to a maintained alternative WordPress theme - this eliminates vulnerability entirely but requires site redesign effort and potential functionality loss; (2) Implement Web Application Firewall (WAF) rules blocking requests containing path traversal patterns (../, %2e%2e%2f, null bytes %00) to theme directory endpoints - effective against automated scans but may cause false positives with legitimate theme functionality; (3) Configure PHP open_basedir directive to restrict file access to WordPress installation directories only - limits LFI impact by preventing access to system files outside web root, though may break plugins expecting broader filesystem access; (4) Enable WordPress file integrity monitoring to detect unauthorized file access attempts - provides detection rather than prevention, useful for incident response but does not block exploitation.