The vulnerability identified as CVE-2026-28019 involves improper control of the filename parameter in PHP include or require statements within the ThemeREX Manoir product. This weakness enables PHP Local File Inclusion, which can be exploited to include unauthorized local files, leading to potential code execution or information disclosure. The issue affects versions up to 1.11 of Manoir. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is released, users should consider restricting access to vulnerable installations and monitor for suspicious activity related to file inclusion attempts.