Cyber Posture

CVE-2026-28048

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech FlashMart flashmart allows PHP Local File Inclusion.This issue affects FlashMart: from n/a through <= 2.0.15.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely identification, reporting, and correction of the specific flaw in the FlashMart theme's PHP include/require statements.

SI-10 Information Input Validation good match
prevent

Mandates validation of filename inputs to the PHP include/require functions, directly addressing the inadequate validation causing this LFI vulnerability.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires scanning for vulnerabilities like this CVE in the WordPress theme, enabling prioritization and remediation before exploitation.

Security SummaryAI

CVE-2026-28048 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the magentech FlashMart WordPress theme in versions from n/a through 2.0.15. This flaw, tied to CWE-98, stems from inadequate validation of filenames in PHP include/require statements within the theme.

The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers without user interaction, though it requires high attack complexity. Successful exploitation allows attackers to include arbitrary local files, potentially resulting in high-impact confidentiality violations through data disclosure, integrity compromises via file manipulation, and availability disruptions, with risks escalating to remote code execution if executable PHP files are included.

Patchstack's advisory documents this as a local file inclusion vulnerability in the WordPress FlashMart theme version 2.0.15, providing vulnerability details and likely mitigation guidance via theme updates or patches, accessible at https://patchstack.com/database/Wordpress/Theme/flashmart/vulnerability/wordpress-flashmart-theme-2-0-15-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

The vulnerability is a public-facing LFI in a WordPress theme exploitable remotely by unauthenticated attackers (T1190), directly enabling unauthorized access to and collection of data from local system files (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References