Cyber Posture

CVE-2026-28018

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through <= 3.20.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the improper filename control in PHP include/require by validating user-supplied inputs against whitelists to block malicious local file paths.

prevent

Requires timely patching or removal of the vulnerable Global Logistics WordPress theme versions up to 3.20 to eliminate the file inclusion flaw.

prevent

Enforces restrictive PHP configuration settings like open_basedir and allow_url_include=Off to limit arbitrary file access even if code flaws exist.

Security SummaryAI

CVE-2026-28018 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeREX Global Logistics WordPress theme. The issue impacts versions from n/a through 3.20 and is associated with CWE-98. It was published on 2026-03-05 with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), potentially allowing local file disclosure or further compromise depending on server configuration.

Patchstack advisories document the Local File Inclusion vulnerability in the Global Logistics WordPress theme up to version 3.20, as detailed in their database entry.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote Local File Inclusion vulnerability in a public-facing WordPress theme directly enables exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References