The vulnerability CVE-2026-28064 in ThemeREX Edge Decor (up to version 2.2) is due to improper control of the filename parameter in PHP include/require statements. This flaw allows PHP Local File Inclusion, enabling an attacker to include local files on the server. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact is rated high due to the potential full compromise of the system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable application to untrusted networks if possible.