The vulnerability CVE-2026-28053 affects ThemeREX Miller versions up to 1.3.3. It arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full system compromise. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This compromises confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is severe, potentially enabling full system compromise.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected ThemeREX Miller theme or restricting access to vulnerable endpoints to trusted users only.