The vulnerability CVE-2026-28096 affects ThemeREX WealthCo through improper validation or control of filenames in PHP include or require statements, leading to PHP Local File Inclusion. This can allow an attacker to execute arbitrary local files on the server, impacting confidentiality, integrity, and availability. The issue affects versions up to 2.18. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the server running WealthCo, potentially leading to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for unusual activity related to file inclusion attempts. Avoid exposing the application to untrusted inputs that could influence file inclusion paths.