The vulnerability CVE-2026-28016 in ThemeREX Luxury Wine is caused by improper validation or control of filenames used in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files or execution of arbitrary code depending on the context. The issue affects versions up to 1.1.14. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include and execute arbitrary local files, potentially gaining unauthorized access or control over the system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.