CVE-2026-28124
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through <= 1.9.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates PHP Local File Inclusion by requiring validation of untrusted inputs controlling include/require filenames in the Notarius theme.
Addresses the vulnerability through timely flaw remediation, such as patching or removing the vulnerable Notarius WordPress theme up to version 1.9.
Enforces secure baseline configurations in PHP, such as disabling allow_url_include and restricting open_basedir, to limit file inclusion exploitation in WordPress environments.
Security SummaryAI
CVE-2026-28124 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Notarius WordPress theme by AncoraThemes. This flaw affects all versions of Notarius up to and including 1.9. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
Attackers can exploit this vulnerability remotely over the network without authentication or user interaction, though it requires high attack complexity. A successful exploitation allows unauthenticated attackers to perform local file inclusion, potentially leading to arbitrary code execution, data disclosure, or system compromise on the targeted WordPress site running the vulnerable Notarius theme.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/notarius/vulnerability/wordpress-notarius-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion issue in Notarius version 1.9 and prior, recommending updates or alternative mitigations for affected WordPress installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in a public-facing WordPress theme exploitable remotely by unauthenticated attackers over the network, directly enabling exploitation of public-facing applications.