What is the CVSS score of CVE-2026-28093?

CVE-2026-28093 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Ozisti WordPress Theme are affected by CVE-2026-28093?

ThemeREX Ozisti WordPress theme versions up to 1.1.10 contain a local file inclusion vulnerability (CVE-2026-28093) that could allow unauthenticated attackers to read arbitrary server files and…

How to fix or mitigate CVE-2026-28093?

Within 24 hours: identify all WordPress installations using ThemeREX Ozisti theme version 1.1.10 or earlier via admin dashboard or security scanner. Within 7 days: contact ThemeREX for patch availability and timeline; if unavailable, disable the theme or migrate to an alternative theme immediately. Within 30 days: upgrade to patched version once released, or complete migration if no patch is forthcoming.

Ozisti WordPress Theme CVE-2026-28093

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:26 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Ozisti ozisti allows PHP Local File Inclusion.This issue affects Ozisti: from n/a through <= 1.1.10.

AnalysisAI

Local file inclusion in ThemeREX Ozisti WordPress theme versions up to 1.1.10 enables remote unauthenticated attackers to read arbitrary files from the web server filesystem and potentially execute PHP code by including malicious local files. Despite the high CVSS score of 8.1, exploitation requires high complexity (AC:H) and EPSS indicates only 0.15% probability of exploitation in the wild (36th percentile), suggesting limited real-world targeting. No active exploitation confirmed by CISA KEV, though Patchstack has documented the vulnerability with security researchers.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), a common flaw in WordPress themes and plugins that dynamically load template files or configuration data. The Ozisti theme by ThemeREX fails to properly sanitize user-controlled input used in file inclusion functions, allowing attackers to manipulate file paths. While classified as 'PHP Remote File Inclusion' in the description, the actual vulnerability is Local File Inclusion (LFI) per the tags and affected product data. LFI differs from RFI in that attackers can only include files already present on the server rather than remotely hosted malicious code. However, LFI can still lead to information disclosure by reading sensitive files like wp-config.php, or achieve code execution by including uploaded files (e.g., malicious images with embedded PHP) or leveraging PHP wrappers and log poisoning techniques.

Affected ProductsAI

ThemeREX Ozisti WordPress theme versions from initial release through 1.1.10 inclusive are vulnerable. The vulnerability affects WordPress installations running this theme regardless of WordPress core version. No specific CPE identifier is provided in the available data. Vendor advisory and patch information are available through Patchstack database at https://patchstack.com/database/Wordpress/Theme/ozisti/vulnerability/wordpress-ozisti-theme-1-1-10-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Ozisti theme to version 1.1.11 or later if available, confirming with ThemeREX or through the Patchstack advisory that the fix addresses CVE-2026-28093. Until patching, implement restrictive file access controls by configuring web server rules to block direct access to theme PHP files except index.php and necessary entry points, though this may break legitimate theme functionality requiring testing. Deploy a WordPress security plugin with virtual patching capabilities (e.g., Wordfence, Patchstack) configured to block malicious file path traversal patterns in HTTP requests targeting the theme directory. If the theme is not actively required, deactivate and switch to a maintained alternative theme, then remove Ozisti files completely. Monitor server logs for suspicious requests containing path traversal sequences (../, %2e%2e%2f) or attempts to access sensitive files (wp-config.php, /etc/passwd) through theme endpoints. Consult the Patchstack database entry for specific indicators of compromise and additional mitigation guidance.