The vulnerability CVE-2026-28098 in ThemeREX Save Life (<= 1.2.13) is caused by improper validation or control of filenames used in PHP include or require statements. This flaw leads to a PHP Local File Inclusion vulnerability, which can be exploited remotely over the network without privileges or user interaction. The CVSS score of 8.1 reflects the high impact on confidentiality, integrity, and availability if exploited. No known exploits in the wild have been reported, and no patch or vendor advisory information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The impact is rated high due to the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying temporary mitigations if documented by the vendor. Monitor the vendor's communications for updates on patches or official workarounds.