The vulnerability CVE-2026-28053 in ThemeREX Miller (<= 1.3.3) is due to improper control of filenames in PHP include or require statements, resulting in a PHP Local File Inclusion flaw. This allows an attacker to potentially include local files on the server, which can lead to arbitrary code execution or information disclosure. The issue affects the Miller theme and has a CVSS v3.1 score of 8.1 with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, potentially allowing attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The high CVSS score reflects significant risk to system confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor ThemeREX communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying strict input validation where possible may reduce risk. Avoid using affected versions of the Miller theme in production environments if feasible.