The vulnerability CVE-2026-28085 affects the ThemeREX Mahogany WordPress theme (versions up to 2.9) and is caused by improper validation or control of filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can manipulate the filename parameter to include unintended local files, potentially executing arbitrary code or accessing sensitive information. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. Since it is a Local File Inclusion vulnerability, attackers may execute arbitrary code or read sensitive files on the server hosting the vulnerable theme. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users of the ThemeREX Mahogany theme should monitor the vendor's official channels for updates or security advisories. Until a fix is available, consider disabling or removing the vulnerable theme to mitigate risk.