CVE-2026-28120 is a PHP Local File Inclusion vulnerability in the ThemeREX Dr.Patterson WordPress theme (versions up to 1.3.2). It arises from improper control over the filename parameter used in include or require statements in PHP code, allowing an attacker to include local files on the server. This can lead to remote code execution or disclosure of sensitive files. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the vulnerable ThemeREX Dr.Patterson theme. This may lead to full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is severe, but exploitation requires high attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or applying manual code review and hardening to prevent unsafe file inclusion. Monitor official ThemeREX channels for updates or patches addressing this vulnerability.