The vulnerability CVE-2026-28011 in ThemeREX Yottis (<= 1.0.10) arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to include arbitrary files on the server, which may lead to disclosure of sensitive information or remote code execution depending on the context. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation can lead to local file inclusion on the affected server, potentially allowing attackers to read sensitive files or execute arbitrary code, impacting confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication or user interaction, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying custom input validation to control filenames used in include/require statements. Monitor official ThemeREX communications for updates.