CVE-2026-28032
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tuning tuning allows PHP Local File Inclusion.This issue affects Tuning: from n/a through <= 1.3.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-28032 by requiring timely patching or updating of the vulnerable ThemeREX Tuning WordPress theme to versions beyond 1.3.
Prevents exploitation of the PHP Local File Inclusion vulnerability by validating user-supplied filenames or paths before use in include/require statements.
Enforces secure PHP configuration settings like open_basedir restrictions to limit the impact of improper filename controls in file inclusion operations.
Security SummaryAI
CVE-2026-28032 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion in the ThemeREX Tuning WordPress theme. This flaw affects Tuning versions from n/a through 1.3 inclusive. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.
Remote attackers without privileges or user interaction can exploit this vulnerability, though it requires high attack complexity. Successful exploitation allows local file inclusion, potentially enabling attackers to read sensitive files, execute arbitrary code under certain conditions, or disrupt system availability, aligning with the high confidentiality, integrity, and availability impacts in the CVSS metrics.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/tuning/vulnerability/wordpress-tuning-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the WordPress Tuning theme version 1.3 and provides guidance on mitigation. Security practitioners should consult this reference for patch availability or workaround recommendations specific to affected installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-28032 is a PHP Remote/Local File Inclusion vulnerability in a public-facing WordPress theme, enabling unauthenticated attackers to exploit the web application over the network.