The vulnerability CVE-2026-28120 in ThemeREX Dr.Patterson theme arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files or execution of arbitrary code depending on the server configuration. The issue affects versions up to 1.3.2. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, no privileges required, and no user interaction needed. No patch or official fix information is currently available.

Successful exploitation of this vulnerability can lead to local file inclusion, potentially exposing sensitive files or enabling remote code execution, thereby compromising confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 indicates a high impact. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or restricting access to the affected application to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.