Cyber Posture

CVE-2026-28052

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Peter Mason petermason allows PHP Local File Inclusion.This issue affects Peter Mason: from n/a through <= 1.4.5.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the PHP local file inclusion vulnerability in the Peter Mason WordPress theme by applying patches or updating to a version beyond 1.4.5.

SI-10 Information Input Validation good match
prevent

Enforces validation of user-supplied filenames in PHP include/require statements to block improper file inclusion paths.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Monitors and scans for vulnerabilities like CVE-2026-28052 in WordPress themes to identify and prioritize remediation.

Security SummaryAI

CVE-2026-28052 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the ThemeREX Peter Mason (petermason) WordPress theme. This flaw impacts versions from n/a through 1.4.5 inclusive and is mapped to CWE-98. Published on 2026-03-05, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by unauthenticated remote attackers over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file inclusion to read sensitive files or execute arbitrary code depending on server configuration.

The primary advisory from Patchstack details this local file inclusion vulnerability in the WordPress Peter Mason theme version 1.4.5 and is available at https://patchstack.com/database/Wordpress/Theme/petermason/vulnerability/wordpress-peter-mason-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this resource for recommended mitigations, such as updating the theme or applying available patches.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of public-facing WordPress application (T1190) leading to local file inclusion for reading sensitive files from the local system (T1005), with potential for code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References