What is the CVSS score of CVE-2026-28095?

CVE-2026-28095 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Marcell Theme are affected by CVE-2026-28095?

ThemeREX Marcell WordPress theme versions 1.2.14 and earlier contain a local file inclusion vulnerability that could allow attackers to read sensitive server files and potentially execute code,…

How to fix or mitigate CVE-2026-28095?

Within 24 hours: Inventory all WordPress installations using ThemeREX Marcell theme and document current versions. Within 7 days: Disable or remove the ThemeREX Marcell theme from all production environments and replace with a patched alternative theme, or isolate affected sites from public network access if replacement is not immediately feasible. Monitor Patchstack and ThemeREX official channels daily for patch release. Within 30 days: Implement file integrity monitoring (FIM) on affected servers and conduct forensic review of web access logs for suspicious file inclusion patterns (e.g., requests containing '../', 'php://', or 'file://' in parameters).

Marcell Theme CVE-2026-28095

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:24 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Marcell marcell allows PHP Local File Inclusion.This issue affects Marcell: from n/a through <= 1.2.14.

AnalysisAI

Local file inclusion in ThemeREX Marcell WordPress theme versions ≤1.2.14 allows remote attackers to read arbitrary files from the server filesystem and potentially execute malicious code. The vulnerability stems from improper validation of file paths in PHP include/require statements. Exploitation probability is low (EPSS 0.15%) with no confirmed active exploitation or public proof-of-concept at time of analysis. Discovered and reported by Patchstack's security audit team.

Technical ContextAI

This vulnerability exists in the Marcell WordPress theme developed by ThemeREX. The flaw is a CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Local File Inclusion (LFI). LFI vulnerabilities occur when user-controlled input influences file path parameters passed to PHP functions like include(), require(), include_once(), or require_once() without proper sanitization. Attackers can manipulate these parameters to traverse directory structures using path traversal sequences (../) or null byte injection to include files outside the intended directory. While classified as PHP Remote File Inclusion in the vulnerability name, the tags and CWE indicate this is actually a Local File Inclusion issue, meaning attackers can access files already present on the server rather than including remote files from external URLs. The affected theme is a commercial WordPress theme, indicating this vulnerability impacts websites using this specific premium theme product through version 1.2.14.

Affected ProductsAI

WordPress sites using the ThemeREX Marcell premium theme versions 1.2.14 and earlier are vulnerable. The vulnerability affects all installations of this commercial WordPress theme from its initial release through version 1.2.14 inclusive. No specific WordPress core version requirements are indicated, suggesting the vulnerability exists independently of the underlying WordPress platform version. The theme is distributed by ThemeREX, a commercial WordPress theme developer. Patchstack's vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-local-file-inclusion-vulnerability provides additional technical details for affected users.

RemediationAI

Update the Marcell theme to version 1.2.15 or later if available, checking the ThemeREX official website or theme marketplace for the latest patched release. Contact ThemeREX support directly to confirm availability of a security-patched version addressing CVE-2026-28095. Reference Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-local-file-inclusion-vulnerability for vendor notification status. If no patched version is immediately available, implement compensating controls: disable the Marcell theme and switch to a different WordPress theme temporarily; restrict file system permissions to prevent PHP processes from reading sensitive configuration files outside the theme directory (set wp-config.php to 0400 permissions); implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests targeting theme endpoints; enable PHP open_basedir directive to restrict file access to WordPress installation directory only, though this may break legitimate theme functionality. Monitor web server access logs for suspicious requests containing directory traversal sequences (../, %2e%2e%2f) or attempts to access configuration files. Note that disabling the theme prevents site functionality if it is the active theme, requiring selection of an alternative theme before deactivation.