The vulnerability CVE-2026-28061 in ThemeREX Tiger Claw arises from improper validation of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited remotely over the network without authentication, but requires high attack complexity. Successful exploitation could lead to complete compromise of the affected system's confidentiality, integrity, and availability. The affected versions are all releases up to and including 1.1.14. The CVSS v3.1 base score is 8.1, indicating high severity. No patch or remediation information is currently available.

If exploited, this vulnerability allows an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable components and applying general PHP security best practices relevant to file inclusion vulnerabilities. Monitor official ThemeREX communications for updates.