The vulnerability CVE-2026-28015 affects ThemeREX ShiftCV through improper control of filenames in PHP include or require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include unintended files on the server, potentially leading to remote code execution or disclosure of sensitive information. The issue impacts versions up to 3.0.14. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive files, or disrupt service. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of ThemeREX ShiftCV up to version 3.0.14 should monitor vendor communications closely and consider restricting access to vulnerable installations until a fix is available.