What is the CVSS score of CVE-2026-28107?

CVE-2026-28107 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Muzicon Theme are affected by CVE-2026-28107?

ThemeREX Muzicon WordPress theme versions 1.9.0 and earlier contain a local file inclusion vulnerability that allows unauthenticated attackers to read sensitive files and potentially execute PHP code…

How to fix or mitigate CVE-2026-28107?

Within 24 hours: Identify all WordPress installations using ThemeREX Muzicon theme and document current versions. Within 7 days: Disable or remove the vulnerable theme; if removal is not feasible, implement Web Application Firewall (WAF) rules to block requests containing file inclusion patterns (e.g., directory traversal sequences in query parameters). Within 30 days: Upgrade to Muzicon version >1.9.0 when available, or migrate to an alternative theme with current security maintenance.

Muzicon Theme CVE-2026-28107

HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-05 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 23, 2026 - 00:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Muzicon muzicon allows PHP Local File Inclusion.This issue affects Muzicon: from n/a through <= 1.9.0.

AnalysisAI

Local file inclusion in ThemeREX Muzicon WordPress theme versions ≤1.9.0 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Despite a CVSS score of 8.1, real-world risk is moderated by high attack complexity (AC:H) and no confirmed active exploitation - EPSS probability is only 0.15% (36th percentile). The Patchstack report confirms the vulnerability but no public exploit code has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP security weakness where user-controlled input influences file path parameters in include() or require() functions without proper sanitization. The Muzicon theme, a WordPress commercial theme by ThemeREX, fails to validate file paths before processing them through PHP's file inclusion mechanisms. Despite the NVD description mentioning 'PHP Remote File Inclusion', the Patchstack classification and vulnerability tags confirm this is actually Local File Inclusion (LFI), meaning attackers read files already present on the server rather than injecting remote code via external URLs. WordPress themes frequently exhibit this pattern when implementing dynamic template loading or AJAX handlers that accept file parameters. The AC:H rating suggests exploitation requires specific conditions beyond a simple GET request, possibly involving authenticated sessions, specific request sequences, or particular theme configuration states.

Affected ProductsAI

The vulnerability affects ThemeREX Muzicon WordPress theme from unknown early versions through version 1.9.0 inclusive. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/muzicon/vulnerability/wordpress-muzicon-theme-1-9-0-local-file-inclusion-vulnerability specifies version 1.9.0 as the last confirmed vulnerable release. Exact initial vulnerable version is not documented (listed as 'n/a' in disclosure), suggesting the flaw may exist in the theme's original codebase. WordPress sites running any Muzicon theme version at or below 1.9.0 should be considered affected.

RemediationAI

Upgrade Muzicon theme to a version newer than 1.9.0 if available from ThemeREX - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/muzicon/vulnerability/wordpress-muzicon-theme-1-9-0-local-file-inclusion-vulnerability for confirmed patched versions. If no patched version exists or immediate upgrade is not feasible, implement compensating controls: disable or remove the Muzicon theme entirely if not actively used; restrict WordPress administrative access to trusted IP addresses via .htaccess or firewall rules (reduces exposure to unauthenticated attackers); enable WordPress application firewall rules via security plugins (Wordfence, Sucuri) to block common LFI patterns in request parameters; audit web server logs for suspicious file path traversal attempts (../, /etc/passwd, wp-config.php references). Note that blocking LFI at the WAF layer may cause false positives if the theme legitimately uses dynamic template loading - test thoroughly in staging environments. File system permissions should already prevent reading sensitive files outside the WordPress directory, but verify that wp-config.php and other critical files have restrictive permissions (640 or 600).