What is the CVSS score of CVE-2026-28094?

CVE-2026-28094 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of RexCoin WordPress Theme are affected by CVE-2026-28094?

CVE-2026-28094 affects ThemeREX RexCoin WordPress theme through version 1.2.6, allowing unauthenticated remote attackers to read arbitrary files and potentially execute code through local file…

How to fix or mitigate CVE-2026-28094?

Within 24 hours: identify all WordPress installations using ThemeREX RexCoin theme versions ≤1.2.6 and deactivate the theme immediately; switch to an alternative WordPress theme from verified sources. Within 7 days: document affected systems in your vulnerability management system and review logs for indicators of exploitation (suspicious file access patterns, unexpected code execution). Within 30 days: establish a process to audit all WordPress themes quarterly and maintain a whitelist of approved themes; monitor Patchstack advisories for vendor patch release and apply immediately upon availability.

RexCoin WordPress Theme CVE-2026-28094

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:25 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX RexCoin rexcoin allows PHP Local File Inclusion.This issue affects RexCoin: from n/a through <= 1.2.6.

AnalysisAI

Local file inclusion in ThemeREX RexCoin WordPress theme versions up to 1.2.6 allows remote attackers to read arbitrary files and potentially achieve code execution without authentication. Despite the high CVSS score of 8.1, the low EPSS percentile (36%) and AC:H complexity suggest limited active exploitation. Patchstack audit team reported this vulnerability with proof-of-concept available, indicating realistic exploit feasibility against improperly configured installations.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The vulnerability exists in RexCoin, a WordPress theme developed by ThemeREX. LFI occurs when an application uses user-supplied input to construct file paths for PHP include() or require() statements without proper sanitization. Despite the CVE description mentioning 'PHP Remote File Inclusion,' the tags and vulnerability classification confirm this as LFI. In WordPress themes, such vulnerabilities commonly arise from improper handling of template file parameters or AJAX action handlers that dynamically load PHP files. The vulnerability affects the theme through version 1.2.6, with the baseline version unclear ('from n/a'), suggesting this may be a long-standing code pattern.

Affected ProductsAI

ThemeREX RexCoin WordPress theme versions 1.2.6 and earlier are confirmed vulnerable. The exact baseline version is unspecified in available data. This is a commercial or custom WordPress theme (not a standard WordPress core or widely distributed plugin), which limits the attack surface to organizations specifically using this theme. Vendor advisory details are available through the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Theme/rexcoin/vulnerability/wordpress-rexcoin-theme-1-2-6-local-file-inclusion-vulnerability.

RemediationAI

Organizations using RexCoin theme should immediately check for updated versions beyond 1.2.6 from ThemeREX or via the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/rexcoin/vulnerability/wordpress-rexcoin-theme-1-2-6-local-file-inclusion-vulnerability. No specific patched version is independently confirmed in available data - contact ThemeREX directly for the latest secure release. If no patch is available and theme removal is not feasible, implement these compensating controls: (1) Restrict theme file access by hardening file permissions (chmod 0400 on theme PHP files prevents modification but may break theme update mechanisms), (2) Deploy a Web Application Firewall rule blocking requests with path traversal sequences (../, ..\ ) in parameters targeting theme directories (may cause false positives on legitimate admin operations), (3) Monitor web server logs for suspicious file access patterns to sensitive files like wp-config.php, (4) Disable PHP allow_url_include directive if enabled (prevents escalation to RFI but does not block LFI itself). Given the theme-specific nature, migration to a well-maintained alternative WordPress theme provides the most sustainable security posture.