The vulnerability CVE-2026-28079 in axiomthemes Conquerors arises from improper validation or control of filenames used in PHP include or require statements. This enables PHP Local File Inclusion (LFI), where an attacker can manipulate the filename parameter to include unintended local files. The affected versions are up to 1.2.13. The CVSS score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is provided in the data.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially exposing sensitive files, enabling code execution, or causing denial of service. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates regarding patches or official fixes.