The vulnerability CVE-2026-28090 in ThemeREX Gamezone arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw allows an attacker to manipulate the filename parameter to include arbitrary local files on the server. The affected versions include all releases up to and including 1.1.11. The CVSS v3.1 base score is 8.1, reflecting a network attack vector with high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, execute arbitrary code, or cause denial of service, severely impacting confidentiality, integrity, and availability of the affected system. The high CVSS score indicates significant risk if exploited. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests. Monitor vendor channels for updates and apply patches promptly once released.