CVE-2026-28118: Welldone PHP File Inclusion Vulnerability

CVE-2026-28118 Overview

CVE-2026-28118 is a Local File Inclusion (LFI) vulnerability affecting the Welldone WordPress theme developed by axiomthemes. The vulnerability stems from improper control of filename for include/require statements in PHP, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). This security flaw allows attackers to include local files from the server, potentially leading to unauthorized access to sensitive configuration files, source code disclosure, and under certain conditions, remote code execution.

Critical Impact

Unauthenticated attackers can exploit this Local File Inclusion vulnerability to read sensitive server files, access WordPress configuration data including database credentials, and potentially achieve code execution on vulnerable WordPress installations.

Affected Products

• WordPress Welldone Theme versions up to and including 2.4
• WordPress installations running vulnerable Welldone theme versions
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2026-03-05 - CVE-2026-28118 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28118

Vulnerability Analysis

This vulnerability exists due to insufficient input validation in the Welldone WordPress theme's file inclusion mechanism. The theme fails to properly sanitize user-supplied input before using it in PHP include() or require() statements, allowing attackers to manipulate the file path and include arbitrary local files from the web server.

Local File Inclusion vulnerabilities in PHP applications typically occur when user-controllable data is passed directly to file inclusion functions without adequate sanitization. In the context of WordPress themes, this often manifests in template loading mechanisms, AJAX handlers, or custom shortcode implementations where file paths are dynamically constructed based on request parameters.

The network-based attack vector means this vulnerability can be exploited remotely without requiring any prior authentication. However, successful exploitation requires the attacker to overcome certain conditions, which accounts for the elevated complexity rating. Successful exploitation can result in complete compromise of the WordPress installation's confidentiality and integrity, with potential impacts including database credential theft, configuration file exposure, and in certain server configurations, remote code execution through log poisoning or file upload chaining techniques.

Root Cause

The root cause of CVE-2026-28118 lies in the improper handling of user-supplied input within the Welldone theme's PHP code. Specifically, the theme accepts external input (such as GET/POST parameters or cookie values) and incorporates this input into file path strings used with PHP's include(), require(), include_once(), or require_once() functions without implementing proper validation, sanitization, or path canonicalization.

This allows attackers to use directory traversal sequences (such as ../) to navigate outside the intended directory scope and include arbitrary files accessible by the web server process.

Attack Vector

The vulnerability is exploitable over the network by sending crafted HTTP requests to the vulnerable WordPress installation. Attackers can manipulate parameters to include files such as /etc/passwd, WordPress configuration files (wp-config.php), or other sensitive server files. In advanced exploitation scenarios, attackers may combine this LFI with other techniques such as:

• Log Poisoning: Injecting PHP code into server logs, then including the log file to achieve code execution
• PHP Wrapper Exploitation: Using PHP stream wrappers like php://filter to read source code or bypass restrictions
• Session File Inclusion: Including PHP session files after injecting malicious session data

The vulnerability mechanism involves manipulating file path parameters to traverse directories and access files outside the intended scope. For detailed technical analysis and exploitation patterns, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-28118

Indicators of Compromise

• Unusual HTTP requests containing directory traversal patterns such as ../, ..%2f, or ..%252f in URL parameters
• Web server access logs showing attempts to access sensitive files like /etc/passwd, wp-config.php, or log files
• Unexpected file access patterns in PHP error logs indicating failed file inclusion attempts
• Evidence of successful file reads in application logs, particularly configuration or credential files

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block directory traversal patterns in HTTP requests
• Implement intrusion detection system (IDS) signatures targeting LFI attack patterns specific to WordPress themes
• Monitor web server access logs for requests containing encoded traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Use SentinelOne's Singularity platform to detect anomalous file access patterns and PHP process behaviors

Monitoring Recommendations

• Enable verbose logging for PHP applications and monitor for file inclusion warnings or errors
• Configure file integrity monitoring on critical WordPress files and system configuration files
• Set up alerting for any access attempts to sensitive files from the web server process
• Implement real-time log analysis to correlate potential LFI exploitation attempts

How to Mitigate CVE-2026-28118

Immediate Actions Required

• Update the Welldone WordPress theme to a patched version if available from axiomthemes
• Temporarily disable or remove the Welldone theme if no patch is available and switch to a secure alternative
• Implement WAF rules to block directory traversal patterns targeting the vulnerable theme components
• Review server logs for any evidence of prior exploitation attempts

Patch Information

Organizations should consult the Patchstack Vulnerability Advisory for the latest patch status and remediation guidance from axiomthemes. Ensure your WordPress installation and all themes are updated to the latest available versions.

Workarounds

• Implement server-level restrictions to prevent PHP from including files outside designated directories using open_basedir configuration
• Deploy ModSecurity or similar WAF with rules targeting LFI patterns and directory traversal attempts
• Restrict file system permissions to limit the web server's ability to read sensitive configuration files
• Consider implementing a virtual patching solution through your WAF until an official patch is released

# PHP configuration hardening example for open_basedir
# Add to php.ini or .htaccess to restrict file inclusion paths
php_admin_value open_basedir "/var/www/html:/tmp"

# ModSecurity rule to block directory traversal patterns
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\)" \
    "id:1001,phase:1,deny,status:403,msg:'Directory Traversal Attempt Detected'"