The vulnerability CVE-2026-28128 in ThemeREX Verse arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw affects all versions of Verse up to 1.7.0. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running ThemeREX Verse, potentially leading to full system compromise including data disclosure, modification, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX communications for updates. Until a fix is available, consider restricting access to the vulnerable application and applying any available workarounds recommended by the vendor. Avoid exposing the affected application to untrusted networks if possible.