CVE-2026-28151: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Select-Themes Tonda

This vulnerability (CVE-2026-28151) affects Select-Themes Tonda versions before 2.6 and is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP. It allows unauthenticated attackers to perform local file inclusion, potentially enabling them to execute arbitrary code or disclose sensitive information. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to remote code execution or sensitive information disclosure without authentication, severely compromising the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts.