Local File Inclusion Vulnerability in ThemeREX ShiftCV by ThemeREX
CVE-2026-28015

8.1HIGH

Key Information:

Vendor

WordPress
Status
Shiftcv
Vendor
CVE Published:
5 March 2026

What is CVE-2026-28015?

A Local File Inclusion vulnerability has been identified in ThemeREX's ShiftCV theme, which allows an attacker to exploit improper control of filename variables within PHP scripts. This flaw can lead to unauthorized file access and execution of harmful code on a vulnerable server. Affected versions include ShiftCV up to 3.0.14, making it crucial for users to apply timely updates to safeguard their web applications against potential breaches.

Affected Version(s)

ShiftCV 0 <= 3.0.14

References

https://patchstack.com/database/Wordpress/Theme/shift-cv/...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
.