Cyber Posture

CVE-2026-28077

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Vapester vapester allows PHP Local File Inclusion.This issue affects Vapester: from n/a through <= 1.1.10.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the specific LFI flaw in the Vapester WordPress theme by requiring identification, reporting, and patching of the vulnerable versions up to 1.1.10.

SI-10 Information Input Validation good match
prevent

Requires validation of user-supplied filenames in PHP include/require statements to block arbitrary local file inclusion attacks.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on filename inputs, such as whitelisting allowed paths, to prevent exploitation of improper filename controls in the theme.

Security SummaryAI

CVE-2026-28077 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeREX Vapester WordPress theme. This issue impacts versions from n/a through 1.1.10 and is associated with CWE-98. The vulnerability was published on 2026-03-05.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with high attack complexity, no privileges or user interaction required, and unchanged scope. Remote attackers can potentially achieve high impacts on confidentiality, integrity, and availability by inducing the inclusion of arbitrary local PHP files.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/vapester/vulnerability/wordpress-vapester-theme-1-1-10-local-file-inclusion-vulnerability?_s_id=cve documents the Local File Inclusion vulnerability specifically in Vapester theme version 1.1.10.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a public-facing WordPress theme flaw allowing unauthenticated remote exploitation via improper filename control in PHP include/require, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References