The vulnerability CVE-2026-28017 in ThemeREX Green Thumb arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw affects versions up to 1.1.12 and allows an attacker to include local files on the server, which can lead to arbitrary code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory details are currently available.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive data, modification of files, and disruption of service. The attacker can execute arbitrary code by including local files, which poses a critical risk to the confidentiality, integrity, and availability of the system running the vulnerable theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable ThemeREX Green Thumb theme or restricting access to the affected system to trusted users only. Monitor official ThemeREX channels for updates and apply patches promptly once available.