CVE-2026-28124: Notarius WordPress Theme LFI Vulnerability

CVE-2026-28124 Overview

CVE-2026-28124 is a PHP Local File Inclusion (LFI) vulnerability affecting the Notarius WordPress theme developed by AncoraThemes. The vulnerability stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing attackers to include arbitrary local files from the server filesystem.

This vulnerability enables remote attackers to read sensitive files, potentially leading to information disclosure, credential theft, or further system compromise. When combined with other vulnerabilities or misconfigurations, LFI can escalate to Remote Code Execution (RCE).

Critical Impact

Remote attackers can exploit this Local File Inclusion vulnerability to read sensitive server files, access configuration data, and potentially achieve code execution on affected WordPress installations running Notarius theme version 1.9 or earlier.

Affected Products

• AncoraThemes Notarius WordPress Theme version 1.9 and earlier
• WordPress installations using vulnerable Notarius theme versions

Discovery Timeline

• 2026-03-05 - CVE-2026-28124 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28124

Vulnerability Analysis

The vulnerability exists due to inadequate input validation in the Notarius WordPress theme when processing user-supplied filenames for PHP include or require statements. The theme fails to properly sanitize file path parameters before incorporating them into file inclusion operations, creating a classic Local File Inclusion attack surface.

An attacker can exploit this weakness by manipulating request parameters to include arbitrary files from the local filesystem. This can expose sensitive configuration files such as wp-config.php, server configuration files like /etc/passwd, or log files that may contain credentials or other sensitive information.

The network-based attack vector with high complexity indicates that while the vulnerability is remotely exploitable, successful exploitation may require specific conditions or additional reconnaissance. No privileges are required for exploitation, and no user interaction is necessary, making this vulnerability particularly dangerous for unattended WordPress installations.

Root Cause

The root cause is improper control of filename parameters in PHP include/require statements (CWE-98). The Notarius theme fails to implement proper input validation, sanitization, or whitelisting of allowed file paths before passing user-controlled input to PHP's file inclusion functions.

Common vulnerable patterns include:

• Direct use of $_GET or $_POST parameters in include() or require() calls
• Insufficient path traversal filtering (e.g., not accounting for encoded sequences like %2e%2e%2f)
• Missing file extension validation or path restriction

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker would craft malicious HTTP requests containing path traversal sequences (such as ../) to navigate outside the intended directory and include sensitive files.

Typical exploitation scenarios include:

• Reading wp-config.php to obtain database credentials
• Accessing /etc/passwd for user enumeration
• Including PHP session files or log files that may contain injected PHP code (log poisoning)
• Reading .htaccess or other configuration files

The vulnerability mechanism involves manipulating file path parameters in HTTP requests. Attackers typically use directory traversal sequences to escape the intended directory context and access sensitive files such as WordPress configuration files or system files. For detailed technical information, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2026-28124

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/) targeting Notarius theme endpoints
• Access log entries showing attempts to include system files like /etc/passwd or wp-config.php
• Unusual file access patterns in PHP error logs referencing files outside the theme directory
• Web Application Firewall (WAF) alerts for LFI pattern matches on WordPress theme requests

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor Apache/Nginx access logs for requests containing ../ sequences targeting the Notarius theme directory
• Implement file integrity monitoring on critical WordPress files to detect unauthorized reads
• Review PHP error logs for "failed to open stream" errors that may indicate exploitation attempts

Monitoring Recommendations

• Configure real-time alerting for WAF rule triggers related to LFI/path traversal attacks
• Set up log aggregation and analysis for WordPress installations to identify attack patterns
• Monitor server resource usage for signs of file enumeration or mass file access attempts
• Enable WordPress security audit logging to track suspicious theme-related requests

How to Mitigate CVE-2026-28124

Immediate Actions Required

• Identify all WordPress installations using the Notarius theme version 1.9 or earlier
• Temporarily deactivate the Notarius theme and switch to a default WordPress theme until a patch is available
• Implement WAF rules to block requests containing path traversal sequences targeting theme files
• Review server access logs for signs of prior exploitation attempts
• Consider restricting access to the WordPress admin panel and theme directories

Patch Information

No official patch information is available at this time. Website administrators should monitor the Patchstack WordPress Vulnerability Report for updates on remediation. Consider contacting AncoraThemes directly for patch availability or upgrade guidance.

Workarounds

• Deactivate the Notarius theme and use an alternative theme until a security update is released
• Implement server-level restrictions using open_basedir PHP directive to limit file access
• Deploy ModSecurity or similar WAF with LFI detection rules enabled
• Use WordPress security plugins that provide real-time protection against file inclusion attacks
• Apply principle of least privilege to web server file system permissions

# Apache ModSecurity rule to block LFI attempts
# Add to your ModSecurity configuration
SecRule REQUEST_URI|ARGS|ARGS_NAMES "@rx (\.\./|\.\.\\)" \
    "id:100001,phase:2,deny,status:403,msg:'LFI Attack Blocked',severity:CRITICAL"

# PHP open_basedir restriction in php.ini or .htaccess
# Restricts PHP file operations to specific directories
# php_value open_basedir /var/www/html/:/tmp/