Cyber Posture

CVE-2026-28047

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of filenames used in PHP include/require statements to block local file inclusion exploits like CVE-2026-28047.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific LFI flaw in the Victo WordPress theme versions through <=1.4.16.

RA-5 Vulnerability Monitoring and Scanning partial match
detectrespond

Provides vulnerability scanning to identify and prioritize the CVE-2026-28047 LFI vulnerability in deployed WordPress themes for remediation.

Security SummaryAI

CVE-2026-28047 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion. It affects the Victo WordPress theme developed by magentech, impacting all versions from n/a through 1.4.16. The vulnerability is mapped to CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The attack scenario involves a remote, unauthenticated attacker (PR:N) exploiting the flaw over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially enabling unauthorized access to local files, data disclosure, modification, or denial of service within the affected WordPress environment.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/victo/vulnerability/wordpress-victo-theme-1-4-16-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in the Victo theme version 1.4.16, serving as a key reference for mitigation guidance.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress theme enables remote file inclusion (RFI/LFI) for arbitrary code execution and file reads, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References