The vulnerability CVE-2026-28030 in ThemeREX Bonbon theme arises from improper validation or control of filenames used in PHP include or require statements. This weakness allows an attacker to perform Local File Inclusion (LFI), potentially enabling arbitrary code execution or disclosure of sensitive files on the affected system. The issue affects Bonbon versions up to and including 1.6. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level.

Successful exploitation of this vulnerability could lead to the execution of arbitrary local files on the server hosting the vulnerable Bonbon theme. This can result in full compromise of the affected web server, including unauthorized access to sensitive data, modification of files, and denial of service. Given the high CVSS score (8.1), the impact is considered severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the available data, users should monitor ThemeREX communications for updates. As a temporary measure, restricting file inclusion paths and disabling risky PHP functions may reduce exposure. Avoid using affected versions of the Bonbon theme until a fix is available.