The vulnerability CVE-2026-28118 in axiomthemes Welldone (versions up to 2.4) is caused by improper control over the filename parameter used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially exposing sensitive files or enabling further attacks. The issue is categorized as a PHP Remote File Inclusion type but specifically manifests as LFI. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or official remediation guidance is currently available from the vendor, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized access to local files, and potentially full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score (8.1) reflects the serious nature of the impact. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing temporary mitigations such as restricting access to vulnerable endpoints, applying web application firewalls (WAF) rules to detect and block suspicious include/require requests, and limiting file system permissions to reduce the impact of potential exploitation.