What is the CVSS score of CVE-2026-28097?

CVE-2026-28097 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Artrium WordPress Theme are affected by CVE-2026-28097?

The Artrium WordPress theme (versions ≤1.0.14) contains a local file inclusion vulnerability allowing unauthenticated remote attackers to read arbitrary server files and potentially execute code,…

How to fix or mitigate CVE-2026-28097?

Within 24 hours: identify all WordPress installations using Artrium theme ≤1.0.14 via site audits or plugin scanners (e.g., Wordfence, Sucuri); document affected instances and business criticality. Within 7 days: contact Artrium developers to confirm patch timeline or alternative mitigation; if no patch timeline is provided, disable or replace Artrium theme with a maintained alternative. Within 30 days: verify all affected instances have either upgraded to theme version >1.0.14 (once available) or been migrated to a patched alternative theme, and conduct post-remediation verification scans.

Artrium WordPress Theme CVE-2026-28097

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:23 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Artrium artrium allows PHP Local File Inclusion.This issue affects Artrium: from n/a through <= 1.0.14.

AnalysisAI

Local file inclusion in Artrium WordPress theme versions ≤1.0.14 allows remote unauthenticated attackers to read arbitrary server files and potentially execute PHP code through improper file inclusion controls. Despite a high CVSS 8.1 score, EPSS shows only 0.15% exploitation probability (36th percentile), suggesting limited real-world targeting. The vulnerability was disclosed by Patchstack's audit team with no confirmed active exploitation or public POC at time of analysis, though LFI vulnerabilities in WordPress themes are commonly targeted once proof-of-concept code becomes available.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP file inclusion weakness. The Artrium theme, developed by ThemeREX for WordPress, fails to properly sanitize or validate user-supplied input before passing it to PHP include/require functions. While classified as PHP Remote File Inclusion (RFI) in the description, Patchstack database and tags categorize this as Local File Inclusion (LFI), suggesting the vulnerability allows reading local server files rather than including remote URLs. This discrepancy likely reflects incomplete allow_url_include configuration analysis. LFI vulnerabilities in WordPress themes typically exploit parameters in AJAX handlers, template loading functions, or customizer callbacks where theme developers accept file paths without adequate path traversal or whitelist validation. The vulnerability class is particularly dangerous in PHP environments where wrapper protocols (php://, data://, zip://) might enable code execution beyond simple file disclosure.

Affected ProductsAI

ThemeREX Artrium WordPress theme versions 1.0.14 and earlier are confirmed vulnerable based on Patchstack database disclosure. The version range notation 'from n/a through ≤1.0.14' indicates all released versions up to and including 1.0.14 contain the flaw, though the initial vulnerable version is not specified. This affects WordPress installations using Artrium as the active theme, regardless of WordPress core version. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/artrium/vulnerability/wordpress-artrium-theme-1-0-14-local-file-inclusion-vulnerability provides additional technical details. No CPE identifier was provided in the dataset, limiting automated vulnerability scanning coverage.

RemediationAI

Update Artrium theme to version 1.0.15 or later if available from ThemeREX, though no specific patched version is confirmed in the provided data. Verify patch availability at the ThemeREX vendor site or Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/artrium/vulnerability/wordpress-artrium-theme-1-0-14-local-file-inclusion-vulnerability). If no patch exists or immediate patching is not feasible, implement compensating controls: disable the Artrium theme and switch to a maintained alternative theme until patch confirmation, restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules (mitigates reconnaissance but not direct exploitation if attack vector is frontend), enable WordPress application firewall rules via plugins like Wordfence or Sucuri that detect LFI patterns in HTTP parameters (may generate false positives requiring tuning), and review web server logs for suspicious patterns like encoded path traversal sequences or attempts to access /etc/passwd, wp-config.php, or .log files. Note that WAF rules may impact legitimate theme functionality if overly aggressive. Monitor ThemeREX communications and WordPress.org theme repository for official security updates.