The vulnerability CVE-2026-28052 in ThemeREX Peter Mason theme arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially accessing sensitive files on the server or executing arbitrary code within the context of the web application. The issue affects all versions up to 1.4.5. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor. The vulnerability is not related to a cloud service and no known active exploitation has been reported.

Successful exploitation of this vulnerability could lead to disclosure of sensitive server files, unauthorized code execution, and potentially full compromise of the affected web server. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to vulnerable endpoints. Monitoring for updates from ThemeREX is recommended. No vendor advisory or patch links are currently provided.