CVE-2026-28086: ThemeREX Run Gran File Inclusion Flaw

CVE-2026-28086 Overview

CVE-2026-28086 is a PHP Local File Inclusion (LFI) vulnerability discovered in the ThemeREX Run Gran WordPress theme. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server. This weakness (CWE-98) can lead to sensitive information disclosure, configuration file exposure, and potentially remote code execution when combined with other attack techniques.

Critical Impact

Attackers can exploit this Local File Inclusion vulnerability to read sensitive server files, access WordPress configuration data including database credentials, and potentially achieve code execution through log poisoning or other LFI-to-RCE techniques.

Affected Products

• ThemeREX Run Gran WordPress Theme versions through 2.0
• WordPress installations using the Run Gran theme
• Web servers hosting vulnerable Run Gran theme deployments

Discovery Timeline

• 2026-03-05 - CVE-2026-28086 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28086

Vulnerability Analysis

This vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The Run Gran WordPress theme fails to properly sanitize user-controlled input before using it in PHP include(), require(), or related functions. This allows attackers to manipulate file paths and include arbitrary files from the local filesystem.

While the vulnerability is categorized as allowing remote file inclusion in the title, the actual exploitable impact is Local File Inclusion. This distinction is important as LFI typically requires the file to already exist on the target server, whereas RFI would allow including files from external URLs.

The network-accessible attack vector with no required privileges makes this vulnerability particularly dangerous for internet-facing WordPress installations. Although exploitation complexity is considered high, successful attacks can result in complete confidentiality, integrity, and availability compromise.

Root Cause

The root cause of CVE-2026-28086 lies in insufficient input validation and sanitization within the Run Gran theme's PHP code. When the theme processes user-supplied input for file inclusion operations, it fails to:

• Validate that the requested file is within allowed directories
• Strip or neutralize directory traversal sequences (e.g., ../)
• Implement a whitelist of permitted files for inclusion
• Use secure file path resolution functions

This allows attackers to traverse outside intended directories and include sensitive system files such as /etc/passwd, WordPress configuration files (wp-config.php), or application logs.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker can craft malicious HTTP requests containing directory traversal sequences or manipulated file paths. These requests target vulnerable parameters in the Run Gran theme that are subsequently used in PHP file inclusion functions.

Common exploitation techniques include:

• Using path traversal sequences (../) to navigate to sensitive files
• Targeting wp-config.php to extract database credentials
• Including log files that contain attacker-controlled content for potential code execution
• Accessing other configuration files that may contain sensitive information

For detailed technical information about this vulnerability, refer to the Patchstack WordPress Vulnerability Database.

Detection Methods for CVE-2026-28086

Indicators of Compromise

• Unusual HTTP requests containing directory traversal patterns (../, ..%2f, ..%5c) targeting theme endpoints
• Access logs showing requests for sensitive file paths through theme parameters
• Unexpected file read operations from the WordPress theme directory
• Error logs indicating failed or successful file inclusion attempts outside normal paths

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal sequences in HTTP requests
• Monitor web server access logs for requests containing traversal patterns targeting the Run Gran theme
• Implement file integrity monitoring on critical WordPress configuration files
• Use SentinelOne Singularity Platform to detect anomalous file access patterns and PHP process behavior

Monitoring Recommendations

• Enable verbose logging for the WordPress installation and web server to capture detailed request information
• Configure alerts for access attempts to sensitive files like wp-config.php or /etc/passwd
• Monitor PHP process behavior for unusual file read operations outside expected directories
• Review web application logs regularly for suspicious patterns indicative of LFI exploitation attempts

How to Mitigate CVE-2026-28086

Immediate Actions Required

• Audit your WordPress installations to identify if the Run Gran theme version 2.0 or earlier is installed
• Consider temporarily deactivating the Run Gran theme until a patched version is available
• Implement WAF rules to block requests containing path traversal sequences
• Review server access logs for evidence of exploitation attempts
• Restrict file permissions to minimize the impact of potential file inclusion attacks

Patch Information

As of the last NVD update on 2026-03-05, users should check the Patchstack advisory for the latest patch status and remediation guidance from ThemeREX. Contact the theme vendor directly for information about security updates addressing this vulnerability.

Workarounds

• Deploy a Web Application Firewall with rules configured to detect and block path traversal attacks
• Implement PHP configuration hardening by setting open_basedir to restrict file access to the WordPress directory
• Use security plugins that provide virtual patching capabilities for WordPress vulnerabilities
• Consider migrating to an alternative WordPress theme that is actively maintained with a strong security track record

# Example PHP configuration hardening in php.ini
# Restrict file operations to WordPress directory
open_basedir = /var/www/html/wordpress/

# Disable dangerous functions if not needed
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

# Log PHP errors for monitoring
log_errors = On
error_log = /var/log/php/error.log