Cyber Posture

CVE-2026-28032

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tuning tuning allows PHP Local File Inclusion.This issue affects Tuning: from n/a through <= 1.3.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2026-28032 by requiring timely patching or updating of the vulnerable ThemeREX Tuning WordPress theme to versions beyond 1.3.

prevent

Prevents exploitation of the PHP Local File Inclusion vulnerability by validating user-supplied filenames or paths before use in include/require statements.

prevent

Enforces secure PHP configuration settings like open_basedir restrictions to limit the impact of improper filename controls in file inclusion operations.

Security SummaryAI

CVE-2026-28032 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion in the ThemeREX Tuning WordPress theme. This flaw affects Tuning versions from n/a through 1.3 inclusive. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.

Remote attackers without privileges or user interaction can exploit this vulnerability, though it requires high attack complexity. Successful exploitation allows local file inclusion, potentially enabling attackers to read sensitive files, execute arbitrary code under certain conditions, or disrupt system availability, aligning with the high confidentiality, integrity, and availability impacts in the CVSS metrics.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/tuning/vulnerability/wordpress-tuning-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the WordPress Tuning theme version 1.3 and provides guidance on mitigation. Security practitioners should consult this reference for patch availability or workaround recommendations specific to affected installations.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2026-28032 is a PHP Remote/Local File Inclusion vulnerability in a public-facing WordPress theme, enabling unauthenticated attackers to exploit the web application over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References