CVE-2026-28025
Local File Inclusion in ThemeREX Stargaze
Publication date: 2026-03-05
Last updated on: 2026-03-06
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themerex | stargaze | to 1.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28025 is a Local File Inclusion (LFI) vulnerability found in the WordPress Stargaze Theme versions up to and including 1.5. It allows unauthenticated attackers to exploit improper control of filename parameters in PHP include/require statements, enabling them to include and display local files from the target website.
This vulnerability falls under the OWASP Top 10 category A3: Injection and can expose sensitive files such as those containing database credentials.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'Exploitation of this vulnerability can lead to the exposure of sensitive files on the affected website, including files with database credentials.'}, {'type': 'paragraph', 'content': "Depending on the website's configuration, attackers could potentially achieve a complete database takeover."}, {'type': 'paragraph', 'content': 'Since the vulnerability allows unauthenticated access to local files, it poses a high security risk.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability allows unauthenticated attackers to include and display local files from the target website by exploiting improper control of filename in PHP include/require statements.'}, {'type': 'paragraph', 'content': 'To detect attempts to exploit this Local File Inclusion (LFI) vulnerability, you can monitor web server logs for suspicious requests containing file inclusion patterns such as "../" sequences or attempts to access sensitive files like /etc/passwd or configuration files.'}, {'type': 'paragraph', 'content': 'Example commands to search for potential exploitation attempts in Apache or Nginx access logs:'}, {'type': 'list_item', 'content': 'grep -iE "(\\.{2}/|etc/passwd|config|\\.ini)" /var/log/apache2/access.log'}, {'type': 'list_item', 'content': 'grep -iE "(\\.{2}/|etc/passwd|config|\\.ini)" /var/log/nginx/access.log'}, {'type': 'paragraph', 'content': 'Additionally, you can use web application firewall (WAF) logs or intrusion detection systems to identify and block suspicious payloads attempting file inclusion.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is available yet for this Local File Inclusion vulnerability in the WordPress Stargaze Theme versions up to 1.5, immediate mitigation is critical.
Users are strongly advised to implement the mitigation rule provided by Patchstack to block attacks exploiting this vulnerability until an official patch is released.
Additional recommended steps include:
- Apply web application firewall (WAF) rules to detect and block malicious file inclusion attempts.
- Restrict file permissions on the server to limit access to sensitive files.
- Monitor server logs for suspicious activity and respond accordingly.
- Consider temporarily disabling or replacing the vulnerable theme until a patch is available.