The vulnerability CVE-2026-28065 in ThemeREX Eject (versions up to 2.17) is caused by improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion (LFI) flaw. This allows an attacker to include and execute local files on the server, which can lead to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, remote code execution, and full system compromise due to the ability to include arbitrary local files. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to vulnerable installations and applying general PHP hardening measures relevant to file inclusion vulnerabilities.