What is the CVSS score of CVE-2026-28098?

CVE-2026-28098 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Save Life WordPress Theme are affected by CVE-2026-28098?

The ThemeREX Save Life WordPress theme (versions 1.2.13 and earlier) contains a local file inclusion vulnerability that allows unauthenticated remote attackers to read sensitive files from affected…

How to fix or mitigate CVE-2026-28098?

Within 24 hours: Inventory all WordPress installations using ThemeREX Save Life theme and document affected versions. Within 7 days: Disable or remove the theme from production environments; if removal is not immediately possible, implement Web Application Firewall rules to block requests to vulnerable theme file paths and restrict file upload permissions to non-executable directories. Within 30 days: Upgrade to a patched version if vendor releases one, or replace with an alternative theme from a maintained source; conduct file integrity checks and review server logs for evidence of exploitation attempts.

Save Life WordPress Theme CVE-2026-28098

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:22 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Save Life save-life allows PHP Local File Inclusion.This issue affects Save Life: from n/a through <= 1.2.13.

AnalysisAI

Local File Inclusion (LFI) in ThemeREX Save Life WordPress theme versions 1.2.13 and earlier enables remote unauthenticated attackers to read arbitrary files from the server filesystem and potentially achieve code execution by including uploaded or log files. Despite the network attack vector (AV:N), high attack complexity (AC:H) suggests successful exploitation requires specific server configurations or carefully crafted payloads. EPSS score of 0.15% (36th percentile) indicates low current exploitation probability, and no active exploitation is confirmed per CISA KEV or public exploit databases at time of analysis.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement) occurs when PHP applications use user-controlled input in file inclusion functions (include, require, include_once, require_once) without proper sanitization. In WordPress themes, this typically manifests through vulnerable AJAX handlers, template loading mechanisms, or custom routing that accept file paths via GET/POST parameters or HTTP headers. While classified as 'PHP Remote File Inclusion' in the description, the CVE title and Patchstack reference correctly identify this as Local File Inclusion - the attacker includes files already on the server (e.g., /etc/passwd, wp-config.php, uploaded images containing PHP code) rather than remote URLs. The Save Life theme by ThemeREX contains such a vulnerability in its file handling routines, allowing path traversal sequences (../) or absolute paths to bypass intended restrictions.

Affected ProductsAI

ThemeREX Save Life WordPress theme versions 1.2.13 and all earlier versions are vulnerable. The vulnerability exists in the theme's core file inclusion mechanisms. According to Patchstack database reference, the issue affects installations where the theme is active regardless of WordPress version, though modern WordPress installations (5.x and 6.x) with security hardening may have additional protections. No CPE string is available in NVD data as this appears to be a recently disclosed commercial theme vulnerability pending full cataloging.

RemediationAI

Immediately update Save Life theme to version 1.2.14 or later if available from ThemeREX, checking the vendor's official repository or ThemeForest marketplace for patched releases. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/save-life/vulnerability/wordpress-save-life-theme-1-2-13-local-file-inclusion-vulnerability for confirmation of fixed versions. If no patch is available, implement compensating controls: disable the Save Life theme and switch to a maintained alternative; restrict wp-admin and AJAX endpoint access to authenticated administrators via .htaccess or WAF rules; enable PHP open_basedir restrictions to confine file access to WordPress directories only (side effect: may break poorly coded plugins expecting unrestricted filesystem access); configure Web Application Firewall rules to block requests containing path traversal patterns (../, %2e%2e%2f, absolute paths like /etc/) in theme-specific parameters; monitor web server logs for suspicious file access attempts targeting theme directories. Note that generic input filtering may cause false positives with legitimate theme features, requiring testing before production deployment.