What is the CVSS score of CVE-2026-28092?

CVE-2026-28092 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Sounder WordPress Theme are affected by CVE-2026-28092?

ThemeREX Sounder WordPress theme versions through 1.3.11 contains a Local File Inclusion vulnerability (CVE-2026-28092) that allows unauthenticated remote attackers to execute arbitrary PHP code on…

How to fix or mitigate CVE-2026-28092?

Within 24 hours: Identify all WordPress installations using ThemeREX Sounder theme and document affected versions. Within 7 days: Disable or remove ThemeREX Sounder theme; implement alternative theme from official WordPress.org repository or verified commercial vendor; apply Web Application Firewall (WAF) rules blocking LFI patterns (e.g., /wp-content/themes/ requests with traversal sequences). Within 30 days: Complete security audit of affected installations for evidence of compromise; review access logs for suspicious file inclusion requests; monitor for unauthorized file modifications.

Sounder WordPress Theme CVE-2026-28092

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 23, 2026 - 00:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Sounder sounder allows PHP Local File Inclusion.This issue affects Sounder: from n/a through <= 1.3.11.

AnalysisAI

Local File Inclusion in ThemeREX Sounder WordPress theme versions through 1.3.11 enables remote attackers to include and execute arbitrary local PHP files without authentication. Despite the CVE title referencing 'Remote File Inclusion', technical analysis and Patchstack classification confirm this is a Local File Inclusion (LFI) vulnerability. With EPSS at 0.15% (36th percentile), widespread exploitation is unlikely, but successful attacks achieve high impact across confidentiality, integrity, and availability. No active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a class of PHP code injection flaws where user-controlled input is passed unsanitized to PHP include(), require(), or similar file inclusion functions. In WordPress themes, this typically occurs when theme files accept parameters (via GET/POST requests or URL paths) that directly influence file paths without proper validation or sanitization. The affected product is the Sounder theme by ThemeREX for WordPress, versions 1.3.11 and earlier. While the CVE description labels this as 'PHP Remote File Inclusion', the Patchstack advisory and tags clearly identify it as Local File Inclusion (LFI), meaning attackers include files already present on the server rather than remote URLs. LFI in WordPress contexts often targets configuration files (wp-config.php), log files, or uploaded content to extract credentials, session tokens, or achieve code execution by chaining with file upload vulnerabilities.

Affected ProductsAI

ThemeREX Sounder WordPress theme versions 1.3.11 and all earlier versions are affected by this Local File Inclusion vulnerability. The CPE or specific version range start point is not specified ('from n/a'), indicating all versions up to and including 1.3.11 should be considered vulnerable. Vendor advisory and patch information are available through Patchstack at https://patchstack.com/database/Wordpress/Theme/sounder/vulnerability/wordpress-sounder-theme-1-3-11-local-file-inclusion-vulnerability. The vulnerability is specific to the Sounder theme product and does not affect other ThemeREX products unless they share the same vulnerable code pattern.

RemediationAI

Immediately upgrade the Sounder theme to version 1.3.12 or later if available from ThemeREX, as the vulnerability affects versions through 1.3.11. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/sounder/vulnerability/wordpress-sounder-theme-1-3-11-local-file-inclusion-vulnerability for vendor-confirmed fix version and patch details. If patched version is not yet released or cannot be immediately deployed, implement the following compensating controls with noted trade-offs: Disable the Sounder theme entirely and switch to a maintained alternative theme (may require design/functionality adjustments). Implement Web Application Firewall (WAF) rules to block common LFI attack patterns in requests to theme files, specifically filtering for path traversal sequences (../, ..\ ), null bytes (%00), and PHP wrapper protocols (php://, file://, data://) in parameters passed to theme endpoints (may cause false positives requiring tuning). Restrict WordPress file permissions to prevent web server user from reading sensitive files like wp-config.php outside the theme directory (standard WordPress hardening, minimal side effects). Deploy file integrity monitoring to detect unauthorized file access attempts or modifications (adds operational overhead for alert triage). Review WordPress access logs for suspicious requests containing traversal patterns to theme files as indicators of exploitation attempts.