The vulnerability CVE-2026-28056 affects ThemeREX MCKinney's Politics theme versions up to 1.2.8. It arises from insufficient validation or control over filenames used in PHP include/require statements, enabling PHP Local File Inclusion. This can allow attackers to include and execute arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is network exploitable without privileges or user interaction but requires high attack complexity. No patch or official fix details are available at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers could execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require statements. This poses a significant security risk to systems running affected versions of the MCKinney's Politics theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor ThemeREX advisories for updates. In the meantime, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests may reduce exposure.