The vulnerability CVE-2026-28014 affects ThemeREX Translogic (<= 1.2.11) and is caused by improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion (LFI) vulnerability. This allows an attacker to include local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to read or execute arbitrary files on the affected server, leading to full compromise of confidentiality, integrity, and availability of the system running ThemeREX Translogic versions up to 1.2.11. This may result in unauthorized access to sensitive data, execution of malicious code, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible, and monitor for any updates from ThemeREX regarding patches or mitigations.