The vulnerability CVE-2026-28117 in axiomthemes smart SEO plugin arises from improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This allows an attacker to include and execute local files on the server, potentially leading to full system compromise. The issue affects smart SEO versions up to and including 2.9. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a high-severity remote vulnerability with high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability could allow remote attackers to include local files on the server running the vulnerable smart SEO plugin, leading to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the potential for significant impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected smart SEO plugin versions to mitigate risk. Monitor vendor communications for updates or patches addressing this vulnerability.