The vulnerability CVE-2026-28029 in ThemeREX EmojiNation plugin arises from improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This flaw affects versions up to and including 1.0.12. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the affected plugin to mitigate risk. Monitor official ThemeREX communications for updates on patches or mitigations.