The ThemeREX MoneyFlow WordPress theme contains a vulnerability identified as CVE-2026-28028, characterized by improper control over the filename used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include arbitrary local files on the server. The vulnerability affects versions up to 1.0 of MoneyFlow. The CVSS 3.1 base score is 8.1, indicating a high-severity issue exploitable remotely without authentication but requiring high attack complexity. The impact includes potential full compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation is currently documented, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the server running the vulnerable MoneyFlow theme. This can lead to disclosure of sensitive information, modification of data, and disruption of service. The CVSS score of 8.1 reflects the high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only. Monitor ThemeREX vendor communications for updates regarding patches or mitigations.