The vulnerability CVE-2026-28051 in ThemeREX Yacht Rental arises from improper validation of filenames in PHP include/require statements, enabling local file inclusion. This can allow an attacker to read arbitrary files on the server or execute unintended code paths. The affected versions are up to and including 2.6. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to disclosure of sensitive server files, unauthorized code execution, and potential full compromise of the affected application. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official patch or fix, users should monitor ThemeREX communications for updates. Avoid exposing the vulnerable application to untrusted networks and consider restricting access until a fix is available.