What is the CVSS score of CVE-2026-27047?

CVE-2026-27047 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27047?

CVE-2026-27047 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27047?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27047

EUVD-2026-15763 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-75vv-9g23-2wpv

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15763

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through <= 2.1.6.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in Mikado-Themes Curly Core plugin for WordPress through version 2.1.6, allowing improper control of filenames in PHP include/require statements. Attackers can exploit this to read arbitrary local files from the affected server, potentially disclosing sensitive configuration files, database credentials, and other confidential data. No CVSS score or EPSS data is currently available, and KEV/active exploitation status is unknown, but the vulnerability has been documented by Patchstack with a public reference URL.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP file inclusion flaw. The Curly Core plugin (identified via CPE cpe:2.3:a:mikado-themes:curly_core:*:*:*:*:*:*:*:*) fails to properly sanitize or validate user-supplied input before passing it to PHP's include() or require() functions. While the description mentions 'PHP Remote File Inclusion,' the tags and ENISA data clarify this is actually a Local File Inclusion (LFI) issue, allowing attackers to include local filesystem paths such as /etc/passwd, WordPress configuration files (wp-config.php), or plugin-specific sensitive files. The vulnerability affects versions from an unspecified baseline through and including version 2.1.6.

RemediationAI

Immediately upgrade the Curly Core plugin to a patched version greater than 2.1.6 (consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/curly-core/vulnerability/wordpress-curly-core-plugin-2-1-6-local-file-inclusion-vulnerability for the exact patched version and timeline). If immediate patching is not possible, temporarily deactivate the Curly Core plugin to prevent exploitation. Additionally, implement file-level access controls to restrict the WordPress web server's read permissions to only necessary files and directories, use a Web Application Firewall (WAF) with rules to detect and block path traversal attempts (../, etc.), monitor server logs for suspicious file access patterns, and consider disabling PHP execution in non-code directories. If available, apply any available security patches from Mikado-Themes; monitor their repository and security channels for release notes.