CVE-2026-28125
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Midi midi allows PHP Local File Inclusion.This issue affects Midi: from n/a through <= 1.14.
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates CVE-2026-28125 by patching the vulnerable Midi WordPress theme to fix the improper filename control in PHP include/require statements.
Information input validation ensures filenames passed to PHP include/require are sanitized and restricted, preventing local file inclusion exploitation.
Configuration settings for PHP, such as open_basedir restrictions and disabling allow_url_include, block unauthorized file access in the vulnerable theme.
Security SummaryAI
CVE-2026-28125 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Midi WordPress theme by AncoraThemes. The issue impacts all versions of the theme up to and including 1.14. Published on 2026-03-05, it is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network with high attack complexity and no user interaction required. Successful exploitation grants high-level impacts on confidentiality, integrity, and availability, potentially allowing attackers to read sensitive local files, modify data, or disrupt services through the file inclusion mechanism.
Mitigation details are outlined in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/midi/vulnerability/wordpress-midi-theme-1-14-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-28125 is a local file inclusion vulnerability in a public-facing WordPress theme, enabling unauthenticated remote attackers to read sensitive files or execute arbitrary code via improper filename control in PHP include/require, directly mapping to T1190: Exploit Public-Facing Application.