Cyber Posture

CVE-2026-28088

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Aqualots aqualots allows PHP Local File Inclusion.This issue affects Aqualots: from n/a through <= 1.1.6.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Remediating the specific flaw in the Aqualots theme's improper filename control for PHP include/require directly prevents exploitation of this LFI vulnerability.

SI-10 Information Input Validation good match
prevent

Validating filenames and paths prior to use in PHP include/require statements directly mitigates the improper control leading to local file inclusion.

CM-6 Configuration Settings partial match
prevent

Secure configuration settings such as PHP open_basedir restrictions limit the scope of file access, mitigating potential impacts of LFI exploitation.

Security SummaryAI

CVE-2026-28088 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and enabling PHP Local File Inclusion, in the ThemeREX Aqualots WordPress theme. This flaw affects Aqualots versions from n/a through 1.1.6 and was published on 2026-03-05.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with high attack complexity, no required privileges or user interaction, and unchanged scope. Unauthenticated remote attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary local file inclusion that could lead to further compromise such as code execution.

The Patchstack advisory provides details on this Local File Inclusion vulnerability in the Aqualots WordPress theme version 1.1.6, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Theme/aqualots/vulnerability/wordpress-aqualots-theme-1-1-6-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2026-28088 is a Local File Inclusion vulnerability in a public-facing WordPress theme exploitable over the network with no privileges, directly enabling T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References