The vulnerability CVE-2026-28088 affects ThemeREX Aqualots versions up to 1.1.6. It is caused by improper control of filenames in PHP include/require statements, which leads to a PHP Local File Inclusion vulnerability. This allows an attacker to include local files on the server, potentially exposing sensitive information or enabling code execution. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack vector is network-based with high attack complexity and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application behavior, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include requests may help mitigate risk.