The vulnerability CVE-2026-28063 in ThemeREX Asia Garden arises from improper control over the filename parameter used in PHP include or require statements. This allows an attacker to perform Local File Inclusion, which can lead to arbitrary code execution or disclosure of sensitive files. The affected versions are up to 1.3.1. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files, potentially executing arbitrary code or accessing sensitive information stored on the server. This could result in system takeover or data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests may help mitigate risk.