PHP Remote File Inclusion Vulnerability in ThemeREX Happy Baby by ThemeREX

CVE-2026-28062

What is CVE-2026-28062?

The ThemeREX Happy Baby theme is susceptible to an improper control of filename for include/require statements, leading to a PHP Local File Inclusion vulnerability. This issue enables an attacker to exploit compromised server configurations, potentially allowing unauthorized access to sensitive files within the server's directory. The vulnerability impacts versions of Happy Baby from its initial release up to and including version 1.2.12, necessitating immediate attention for users to protect their sites from potential exploitation.

References