The vulnerability CVE-2026-28026 affects the ThemeREX Motorix product up to version 1.6. It is caused by improper validation or control of filenames used in PHP include or require statements, which leads to a Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to include files from the local filesystem, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or disrupt service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require parameter usage.