The vulnerability CVE-2026-28046 affects ThemeREX Law Office versions up to 3.3.0 and is caused by improper validation of filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, enabling an attacker to include and execute local files on the server. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to execute arbitrary code, disclose sensitive information, or disrupt service on the affected system. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and closely monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.