The vulnerability CVE-2026-28017 affects ThemeREX Green Thumb theme versions up to 1.1.12. It arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official fix details are currently available.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score indicates severe impact potential. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to vulnerable installations, disable or limit PHP include/require functionality where possible, and monitor for suspicious activity related to file inclusion attempts. Avoid using affected versions of the Green Thumb theme if possible.