The vulnerability CVE-2026-28033 affects ThemeREX Edifice versions up to 1.8 and is caused by improper control of filenames in PHP include/require statements. This flaw enables PHP Local File Inclusion, allowing an attacker to include and execute local files on the server. The CVSS 3.1 score is 8.1 (high), indicating network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible, or applying other protective controls such as web application firewalls to detect and block attempts to exploit local file inclusion. Monitor vendor channels for updates and patches.