This vulnerability (CVE-2026-28089) in ThemeREX Daiquiri versions up to 1.2.4 arises from improper control over filenames used in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to include local files on the server, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently available, and no exploits have been reported in the wild.

Successful exploitation could allow an attacker to include and execute local files on the affected server, potentially leading to full compromise of confidentiality, integrity, and availability of the system running ThemeREX Daiquiri. This could result in unauthorized access to sensitive data, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor official ThemeREX channels for updates.