What is the CVSS score of CVE-2026-28096?

CVE-2026-28096 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WealthCo Theme are affected by CVE-2026-28096?

ThemeREX WealthCo WordPress theme versions up to 2.18 contain a remote file inclusion vulnerability that could allow unauthenticated attackers to execute arbitrary PHP code on affected websites.

How to fix or mitigate CVE-2026-28096?

Within 24 hours: Identify all WordPress installations using ThemeREX WealthCo theme and document versions in use; audit web application firewall (WAF) logs for suspicious file inclusion attempts targeting the affected theme. Within 7 days: Contact ThemeREX for patch availability and estimated timeline; if no patch forthcoming, implement input validation rules in your WAF to block requests with path traversal patterns (../, ..\ , encoded variants) targeting theme directories. Within 30 days: Either upgrade to a patched version of ThemeREX WealthCo if released, or migrate to an alternative WordPress theme with active security support; validate remediation through automated vulnerability scanning.

WealthCo Theme CVE-2026-28096

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:23 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through <= 2.18.

AnalysisAI

Remote file inclusion vulnerability in ThemeREX WealthCo WordPress theme versions up to 2.18 allows unauthenticated remote attackers to include and execute arbitrary PHP files via manipulated filename parameters. Despite CVSS 8.1 rating, EPSS exploitation probability is low (0.15%, 36th percentile) with no CISA KEV listing or public exploit identified at time of analysis. Vulnerability stems from improper validation of file paths in PHP include/require statements, though attack complexity is rated High, suggesting specific conditions or chained exploitation required.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement) in the WealthCo WordPress theme. PHP's include() and require() functions dynamically load files based on supplied paths. When user-controlled input influences these paths without proper validation or sanitization, attackers can manipulate the filename parameter to include local files (LFI) or potentially remote files if allow_url_include is enabled in PHP configuration. The vulnerability exists in theme code where file paths are constructed using unsanitized user input, typically through GET/POST parameters or HTTP headers. Tagged as both PHP Remote File Inclusion and Local File Inclusion, the actual exploitability depends on server PHP configuration (allow_url_include and allow_url_fopen settings) and specific vulnerable code paths within the theme's PHP files. WordPress themes execute with web server privileges, making successful exploitation particularly impactful.

Affected ProductsAI

ThemeREX WealthCo WordPress theme versions from earliest release through version 2.18 are confirmed vulnerable per Patchstack advisory. The vulnerability exists in the theme's PHP code handling file inclusion operations. Specific affected installations are WordPress sites using WealthCo theme version 2.18 or earlier. No CPE identifier provided in available data. Official vulnerability details available at https://patchstack.com/database/Wordpress/Theme/wealthco/vulnerability/wordpress-wealthco-theme-2-18-local-file-inclusion-vulnerability?_s_id=cve (Patchstack advisory reference).

RemediationAI

Update WealthCo theme to version 2.19 or later if available (patch version not independently confirmed from provided data; consult ThemeREX vendor or Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wealthco/vulnerability/wordpress-wealthco-theme-2-18-local-file-inclusion-vulnerability?_s_id=cve for exact patched version). If immediate patching is not feasible, implement compensating controls: disable the WealthCo theme and switch to a patched alternative WordPress theme until update is available; verify PHP configuration has allow_url_include set to Off (default in PHP 5.2+) to prevent remote file inclusion escalation, though this does not prevent local file inclusion attacks; implement Web Application Firewall (WAF) rules to detect and block requests with path traversal sequences (../, %2e%2e%2f) or null byte injection (%00) in parameters targeting theme files, noting this may cause false positives with legitimate file operations; restrict file system permissions on sensitive configuration files (wp-config.php, .htaccess) to prevent disclosure via LFI, though this does not prevent code execution scenarios. Monitor WordPress access logs for suspicious requests containing encoded path traversal or file protocol handlers (file://, php://, data://) targeting theme directories.