The vulnerability CVE-2026-28026 in ThemeREX Motorix arises from improper validation or control of filenames used in PHP include or require statements. This improper control allows local file inclusion, which can be leveraged by attackers to execute arbitrary code or disclose sensitive information. The affected versions are Motorix up to 1.6. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to local file inclusion, enabling attackers to execute arbitrary code or access sensitive files on the affected system. This results in a high impact on confidentiality, integrity, and availability of the system running the vulnerable Motorix version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests.