The vulnerability CVE-2026-28035 in ThemeREX Printy arises from improper validation or control of filenames in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files or execution of arbitrary code depending on the server configuration. The affected versions include all versions up to and including 1.8. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to an attacker reading sensitive files on the server or executing arbitrary code, severely impacting confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is considered high. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds from the vendor. Avoid exposing the affected application to untrusted networks if possible.