The vulnerability CVE-2026-28054 in ThemeREX Legal Stone arises from improper validation or control over filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), enabling them to include and execute arbitrary files on the server. The affected versions are up to and including 1.2.11. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the server hosting the Legal Stone theme, potentially leading to full system compromise including unauthorized disclosure, modification, or destruction of data and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only. Monitor official ThemeREX communications for updates and apply patches promptly once available.