The vulnerability CVE-2026-28046 affects ThemeREX Law Office versions up to 3.3.0 and is caused by improper control of filenames in PHP include/require statements. This flaw allows PHP Local File Inclusion, enabling an attacker to potentially execute arbitrary local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the affected server. This compromises confidentiality, integrity, and availability of the system running ThemeREX Law Office up to version 3.3.0. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks if possible.