The vulnerability CVE-2026-28022 in ThemeREX Foodie (<= 1.14) is caused by improper validation of filenames used in PHP include/require statements, enabling PHP Local File Inclusion. This allows an unauthenticated remote attacker to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is not related to remote file inclusion despite the title mentioning it; the description specifies local file inclusion. No patch or official fix is currently documented, and the vendor has not provided advisory or remediation details. Exploitation requires network access but no privileges or user interaction.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability by allowing an attacker to include and execute arbitrary local files. This may result in disclosure of sensitive data, code execution, or denial of service. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected ThemeREX Foodie versions or applying manual code review and hardening to prevent local file inclusion. Monitor vendor channels for updates and patches.