The vulnerability CVE-2026-28022 in ThemeREX Foodie arises from improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker to include arbitrary local files on the server, which can lead to remote code execution or information disclosure. The affected versions are up to and including 1.14. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to an attacker including and executing arbitrary local files on the server running ThemeREX Foodie, potentially resulting in full compromise of the system's confidentiality, integrity, and availability. This could allow unauthorized access to sensitive information, code execution, or denial of service. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests targeting include/require parameters.