The vulnerability CVE-2026-28062 affects the ThemeREX Happy Baby WordPress theme (versions <= 1.2.12) and arises from improper validation of filenames used in PHP include or require statements. This improper control enables a Local File Inclusion (LFI) attack, where an attacker can cause the application to include unintended local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation of this vulnerability allows an unauthenticated attacker to include local files on the server, which can lead to disclosure of sensitive information, remote code execution, and full system compromise. The impact is rated high due to the potential for complete control over the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX communications for updates. As a temporary mitigation, restricting file inclusion paths or disabling vulnerable features may reduce risk, but these are not confirmed by the vendor. Avoid exposing the affected application to untrusted networks until a fix is applied.