The ThemeREX Beacon plugin up to version 2.24 contains a vulnerability classified as CVE-2026-28050, characterized by improper control of the filename used in PHP include/require statements. This leads to a Local File Inclusion vulnerability, allowing an attacker to include local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, but with high attack complexity and no required privileges or user interaction. No patch or official remediation guidance is currently provided by the vendor, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the server hosting the ThemeREX Beacon plugin, potentially leading to full system compromise including data disclosure, modification, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. However, the attack complexity is high, and no privileges or user interaction are required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin if feasible. Monitor ThemeREX communications for updates and apply patches promptly once available.