Cyber Posture

CVE-2026-28029

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX EmojiNation emojination allows PHP Local File Inclusion.This issue affects EmojiNation: from n/a through <= 1.0.12.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Remediating the specific PHP Local File Inclusion flaw in the EmojiNation WordPress theme up to version 1.0.12 directly eliminates the vulnerability to remote exploitation.

SI-10 Information Input Validation good match
prevent

Validating filenames supplied to PHP include/require statements in the theme prevents attackers from injecting paths leading to unauthorized local file inclusion.

CM-6 Configuration Settings partial match
prevent

Enforcing secure PHP configuration settings like disabling allow_url_include and restricting open_basedir limits the scope of file inclusion even if input validation fails.

Security SummaryAI

CVE-2026-28029 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the ThemeREX EmojiNation WordPress theme. This issue affects EmojiNation versions from n/a through 1.0.12.

The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited over the network by unauthenticated attackers requiring high attack complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, such as unauthorized file access or potential code execution via local file inclusion.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/emojination/vulnerability/wordpress-emojination-theme-1-0-12-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References