CVE-2026-28030: WordPress Bonbon theme <= 1.6 - Local File Inclusion vulnerability

Q: Does an attacker need an account or user interaction to exploit this issue?

No. The CVSS vector indicates no privileges are required and no user interaction is required; the attack vector is network-based.

Q: Which installations should be considered affected?

Bonbon versions through 1.6 are listed as affected. The lower bound is unspecified, so deployments using any known Bonbon version at or below 1.6 should be reviewed.

Q: What could successful exploitation allow?

The listed CVSS impacts are high for confidentiality, integrity, and availability. Exploitation complexity is rated high, meaning additional conditions are likely required even though the attack is network-accessible.

Published Mar 5, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Bonbon bonbon allows PHP Local File Inclusion.This issue affects Bonbon: from n/a through <= 1.6.

Affected Software

2 affected components

ThemeREX Bonbon<=1.6

WordPress Bonbon<=1.6

Event History

Mar 5, 2026

CVE Published

via MITRE·05:54 AM

Data Sourced

via MITRE·05:54 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account or user interaction to exploit this issue?

No. The CVSS vector indicates no privileges are required and no user interaction is required; the attack vector is network-based.

Which installations should be considered affected?

Bonbon versions through 1.6 are listed as affected. The lower bound is unspecified, so deployments using any known Bonbon version at or below 1.6 should be reviewed.

What could successful exploitation allow?