CVE-2026-28124
Published: 05 March 2026
Summary
CVE-2026-28124 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-28124 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Notarius WordPress theme by AncoraThemes. This flaw affects all versions of Notarius up to and including 1.9. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
Attackers can exploit this vulnerability remotely over the network without authentication or user interaction, though it requires high attack complexity. A successful exploitation allows unauthenticated attackers to perform local file inclusion, potentially leading to arbitrary code execution, data disclosure, or system compromise on the targeted WordPress site running the vulnerable Notarius theme.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/notarius/vulnerability/wordpress-notarius-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion issue in Notarius version 1.9 and prior, recommending updates or alternative mitigations for affected WordPress installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9776
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through <= 1.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in a public-facing WordPress theme exploitable remotely by unauthenticated attackers over the network, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates PHP Local File Inclusion by requiring validation of untrusted inputs controlling include/require filenames in the Notarius theme.
Addresses the vulnerability through timely flaw remediation, such as patching or removing the vulnerable Notarius WordPress theme up to version 1.9.
Enforces secure baseline configurations in PHP, such as disabling allow_url_include and restricting open_basedir, to limit file inclusion exploitation in WordPress environments.