The vulnerability CVE-2026-28057 in ThemeREX Mandala arises from improper control of the filename parameter used in PHP include or require statements, enabling local file inclusion. This flaw affects Mandala versions up to 2.8 and can be exploited remotely over the network without privileges or user interaction, but requires high attack complexity. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the system running the vulnerable software. No official patch or vendor advisory details are currently available.

Exploitation of this vulnerability can lead to full system compromise, including disclosure of sensitive information, modification of data, and disruption of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying other protective controls specific to PHP file inclusion vulnerabilities.