CVE-2026-28066
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legrand legrand allows PHP Local File Inclusion.This issue affects Legrand: from n/a through <= 2.17.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates improper control of filenames in PHP include/require by requiring validation and sanitization of inputs to prevent local file inclusion.
Ensures timely patching of the vulnerable Legrand WordPress theme versions through <=2.17 to remediate the specific LFI flaw.
Establishes restrictive PHP configuration settings like open_basedir to limit file system access and block LFI exploitation attempts.
Security SummaryAI
CVE-2026-28066 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, in the ThemeREX Legrand WordPress theme. This flaw affects Legrand versions from n/a through 2.17.
Unauthenticated attackers with network access can exploit the vulnerability, which requires high attack complexity and no user interaction. Exploitation yields high impacts on confidentiality, integrity, and availability, per its CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), potentially allowing inclusion of arbitrary local files.
The Patchstack advisory provides details on this WordPress Legrand theme vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Theme/legrand/vulnerability/wordpress-legrand-theme-2-17-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-28066 is a network-accessible LFI/RFI vulnerability in a public-facing WordPress theme, enabling unauthenticated attackers to achieve RCE or local file disclosure, directly mapping to Exploit Public-Facing Application (T1190).