What is the CVSS score of CVE-2026-28091?

CVE-2026-28091 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Coleo Theme are affected by CVE-2026-28091?

ThemeREX Coleo WordPress theme versions 1.1.7 and earlier contain a local file inclusion vulnerability that could allow attackers to read sensitive files and execute code on affected sites.

How to fix or mitigate CVE-2026-28091?

Within 24 hours: Identify all WordPress installations using ThemeREX Coleo theme via admin dashboard or security scanner; deactivate the theme immediately as a precautionary measure. Within 7 days: Replace Coleo with an alternative theme or contact ThemeREX for guidance on version status; verify no unauthorized file access occurred via server logs. Within 30 days: Implement Web Application Firewall (WAF) rules to block file inclusion attempts; conduct full WordPress security audit including installed plugins and user accounts.

Coleo Theme CVE-2026-28091

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Coleo coleo allows PHP Local File Inclusion.This issue affects Coleo: from n/a through <= 1.1.7.

AnalysisAI

Local file inclusion in ThemeREX Coleo WordPress theme (versions ≤1.1.7) allows remote attackers to read arbitrary files and potentially execute PHP code via crafted file path manipulation. Despite high CVSS 8.1, exploitation requires high attack complexity (AC:H), and EPSS score of 0.15% (36th percentile) suggests limited real-world exploitation activity. No CISA KEV listing indicates this is not confirmed as actively exploited, though Patchstack database inclusion suggests security researcher identification and likely proof-of-concept existence.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), a classic weakness where user-controlled input influences which files are loaded by the PHP interpreter. The Coleo theme, developed by ThemeREX for WordPress, fails to sanitize filename parameters before passing them to include/require functions. While classified as 'PHP Remote File Inclusion' in the description, tags and references indicate this is actually Local File Inclusion (LFI), meaning attackers can read files already present on the server rather than inject external code directly. The distinction matters: LFI typically requires chaining with other vulnerabilities (like log poisoning or PHP wrappers) to achieve code execution, whereas RFI allows direct remote code injection if allow_url_include is enabled in php.ini (disabled by default since PHP 5.2).

Affected ProductsAI

ThemeREX Coleo WordPress theme versions 1.1.7 and earlier are confirmed vulnerable per Patchstack database analysis. The vulnerability affects all installations running these versions regardless of WordPress core version, though exploitation conditions may vary based on server configuration and enabled features. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/coleo/vulnerability/wordpress-coleo-theme-1-1-7-local-file-inclusion-vulnerability provides detailed affected version information, though specific CPE identifiers are not available in public databases for this WordPress theme.

RemediationAI

Upgrade to Coleo theme version 1.1.8 or later if available from ThemeREX (verify current version on vendor website as exact patched version is not independently confirmed in NVD data). Until patching, implement defense-in-depth controls: disable the Coleo theme and switch to a maintained alternative if not actively required for production sites, restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to prevent unauthorized theme configuration changes, enable PHP open_basedir restrictions in php.ini to limit file access to WordPress directories only (note: may break legitimate plugins requiring broader filesystem access), monitor web server logs for suspicious file path patterns containing traversal sequences (../, absolute paths, or PHP wrapper schemes like php://filter). Review Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/coleo/vulnerability/wordpress-coleo-theme-1-1-7-local-file-inclusion-vulnerability for vendor-specific guidance. Note that open_basedir restrictions may cause compatibility issues with backup plugins or file managers that legitimately access parent directories.