CVE-2026-28021: WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through <= 1.2.8.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Craftis installations from an unspecified starting version through version 1.2.8 are affected. The data does not identify any unaffected fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is needed; the attack vector is network-based.
How feasible and impactful is exploitation?
The vulnerability has high attack complexity, so exploitation requires conditions beyond simply reaching the target. If successfully exploited, the CVSS assessment indicates high potential impact to confidentiality, integrity, and availability.