PHP Remote File Inclusion Vulnerability in ThemeREX Police Department Product

CVE-2026-28049

What is CVE-2026-28049?

A vulnerability exists in the ThemeREX Police Department theme that allows for improper control over filenames in include or require statements. This could lead to local file inclusion, enabling attackers to exploit the system and potentially access sensitive files stored on the server. Users of the Police Department theme, particularly those using version 2.17 or earlier, should take immediate actions to patch this vulnerability to safeguard their systems from potential security threats.

References