CVE-2026-28091
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Coleo coleo allows PHP Local File Inclusion.This issue affects Coleo: from n/a through <= 1.1.7.
Analysis
ThemeREX Coleo plugin versions 1.1.7 and earlier contain a local file inclusion vulnerability in PHP file handling that allows unauthenticated attackers to read arbitrary files from the affected server. The improper validation of include/require statements enables attackers to access sensitive configuration files and potentially execute code by including malicious files. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems running Coleo <= 1.1.7 and assess exposure; disable the theme if not actively required for business operations. Within 7 days: Implement compensating controls including WAF rules to block suspicious file inclusion attempts, restrict theme functionality through .htaccess rules, and monitor access logs for exploitation indicators. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today