The vulnerability CVE-2026-28061 in ThemeREX Tiger Claw arises from improper validation of filenames used in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially exposing sensitive information or enabling code execution. The issue affects all versions through 1.1.14. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability could lead to disclosure of sensitive files, unauthorized code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score indicates significant risk if exploited. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should monitor ThemeREX communications for updates. Avoid exposing vulnerable versions to untrusted networks and consider applying temporary mitigations such as disabling vulnerable functionality if feasible.