The vulnerability CVE-2026-28107 in ThemeREX Muzicon arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the server. The issue affects Muzicon versions up to 1.9.0. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could lead to remote code execution or unauthorized access to sensitive files, compromising the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is significant, potentially allowing attackers to fully control the affected server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable functionality, applying web application firewalls to block suspicious requests, and monitoring for unusual activity related to file inclusion attempts. Avoid exposing the affected Muzicon versions publicly if possible.