CVE-2026-28018
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through <= 3.20.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the improper filename control in PHP include/require by validating user-supplied inputs against whitelists to block malicious local file paths.
Requires timely patching or removal of the vulnerable Global Logistics WordPress theme versions up to 3.20 to eliminate the file inclusion flaw.
Enforces restrictive PHP configuration settings like open_basedir and allow_url_include=Off to limit arbitrary file access even if code flaws exist.
Security SummaryAI
CVE-2026-28018 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeREX Global Logistics WordPress theme. The issue impacts versions from n/a through 3.20 and is associated with CWE-98. It was published on 2026-03-05 with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), potentially allowing local file disclosure or further compromise depending on server configuration.
Patchstack advisories document the Local File Inclusion vulnerability in the Global Logistics WordPress theme up to version 3.20, as detailed in their database entry.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote Local File Inclusion vulnerability in a public-facing WordPress theme directly enables exploitation of a public-facing application.