Cyber Posture

CVE-2026-28051

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yacht Rental yacht-rental allows PHP Local File Inclusion.This issue affects Yacht Rental: from n/a through <= 2.6.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely identification, prioritization, and remediation of the specific LFI flaw in Yacht Rental theme versions through <=2.6, preventing exploitation.

prevent

Mandates validation of untrusted inputs controlling PHP include/require filenames to block arbitrary local file inclusion attacks.

prevent

Enforces secure PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit file inclusion capabilities exploited by this vulnerability.

Security SummaryAI

CVE-2026-28051 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98), affecting the ThemeREX Yacht Rental (yacht-rental) WordPress theme. The vulnerability impacts all versions from n/a through 2.6 inclusive. Published on 2026-03-05, it carries a CVSS v3.1 base score of 8.1 (High: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Remote unauthenticated attackers (PR:N) can exploit this over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation enables high-impact outcomes on confidentiality, integrity, and availability (C:H/I:H/A:H), such as including and executing arbitrary local files, potentially leading to sensitive data exposure, code execution, or service disruption on the targeted WordPress site.

The Patchstack advisory provides details on this Local File Inclusion vulnerability in the Yacht Rental WordPress theme version 2.6; practitioners should consult https://patchstack.com/database/Wordpress/Theme/yacht-rental/vulnerability/wordpress-yacht-rental-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as applying patches or upgrading the theme.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remote file inclusion flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References