The vulnerability CVE-2026-28054 in ThemeREX Legal Stone arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to execution of arbitrary code or disclosure of sensitive files on the server. The issue affects versions up to 1.2.11. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of ThemeREX Legal Stone should monitor vendor communications for updates. Until a fix is available, consider disabling or restricting access to vulnerable functionality if possible.