The vulnerability CVE-2026-28020 in ThemeREX Chroma (versions up to 1.11) arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially enabling arbitrary file inclusion on the server. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to an attacker including arbitrary files on the server, which may result in disclosure of sensitive information, code execution, or denial of service. The high CVSS score indicates that the impact on confidentiality, integrity, and availability is severe. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any available workarounds from the vendor. Monitor for updates from ThemeREX regarding patches or mitigations.