A vulnerability marked as critical has been reported in ThemeREX Run Gran Plugin up to 2.0 on WordPress. Impacted is an unknown function. Performing a manipulation results in improper control of filename for include/require statement in php program (‘php remote file inclusion’).
This vulnerability is identified as CVE-2026-28086. The attack can be initiated remotely. There is not any exploit available.
