CVE-2026-28051
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yacht Rental yacht-rental allows PHP Local File Inclusion.This issue affects Yacht Rental: from n/a through <= 2.6.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, prioritization, and remediation of the specific LFI flaw in Yacht Rental theme versions through <=2.6, preventing exploitation.
Mandates validation of untrusted inputs controlling PHP include/require filenames to block arbitrary local file inclusion attacks.
Enforces secure PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit file inclusion capabilities exploited by this vulnerability.
Security SummaryAI
CVE-2026-28051 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98), affecting the ThemeREX Yacht Rental (yacht-rental) WordPress theme. The vulnerability impacts all versions from n/a through 2.6 inclusive. Published on 2026-03-05, it carries a CVSS v3.1 base score of 8.1 (High: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote unauthenticated attackers (PR:N) can exploit this over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation enables high-impact outcomes on confidentiality, integrity, and availability (C:H/I:H/A:H), such as including and executing arbitrary local files, potentially leading to sensitive data exposure, code execution, or service disruption on the targeted WordPress site.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the Yacht Rental WordPress theme version 2.6; practitioners should consult https://patchstack.com/database/Wordpress/Theme/yacht-rental/vulnerability/wordpress-yacht-rental-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as applying patches or upgrading the theme.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote file inclusion flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application for remote code execution.