CVE-2026-28096
Published: 05 March 2026
Summary
CVE-2026-28096 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-28096 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and labeled as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion. It affects the ThemeREX WealthCo WordPress theme, with vulnerable versions spanning from n/a through 2.18 inclusive. The vulnerability was published on 2026-03-05 and carries a CVSS v3.1 base score of 8.1.
The vulnerability can be exploited remotely over the network (AV:N) by unauthenticated attackers (PR:N) with no user interaction required (UI:N), though it demands high attack complexity (AC:H) and does not change scope (S:U). Successful exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing attackers to read sensitive local files, execute arbitrary code, or disrupt theme functionality.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wealthco/vulnerability/wordpress-wealthco-theme-2-18-local-file-inclusion-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9751
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through <= 2.18.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in a public-facing WordPress theme enables unauthenticated remote exploitation of a web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper control of filenames in PHP include/require statements by requiring validation of inputs to prevent local file inclusion attacks.
Requires identification, reporting, and correction of the specific flaw in WealthCo theme versions through 2.18, enabling timely patching to eliminate the vulnerability.
Enforces secure PHP configuration settings like open_basedir or disable_functions to restrict file access paths and mitigate exploitation of file inclusion flaws.