The vulnerability CVE-2026-28092 in ThemeREX Sounder (<= 1.3.11) arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw allows an attacker to include and execute local files on the server, which can lead to complete compromise of the system's confidentiality, integrity, and availability. The CVSS v3.1 score is 8.1, reflecting a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official fix details are currently available, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion on the affected server, potentially allowing attackers to read sensitive files, execute arbitrary code, and fully compromise the system's confidentiality, integrity, and availability. The CVSS score of 8.1 indicates a high impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin and review server configurations to limit exposure. Monitor vendor channels for updates and apply patches promptly once released.