The vulnerability CVE-2026-28079 in axiomthemes Conquerors arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows local file inclusion (LFI), enabling attackers to include and execute files on the server that should not be accessible. Affected versions are up to 1.2.13. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor patch or mitigation details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable versions and applying any recommended configuration changes from the vendor. Monitor vendor channels for updates and apply patches promptly once available.