The vulnerability CVE-2026-28049 affects the ThemeREX Police Department plugin (up to version 2.17) and is characterized by improper control of filenames in PHP include/require statements. This leads to a Local File Inclusion vulnerability, which can allow an attacker to include and execute arbitrary files on the server. The CVSS v3.1 score is 8.1, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, and potentially take full control over the affected system. The impact is rated high across confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users of the ThemeREX Police Department plugin should monitor the vendor's advisories for updates and apply any official fixes once available. Until then, consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious requests related to file inclusion attempts.