PHP CVE-2026-27048

Requires WordPress installation with Elated-Themes 'The Aisle Core' plugin version <= 2.0.5 enabled. Attacker must identify exploitable include/require statement parameter accepting unvalidated user input. No authentication required for remote exploitation; victim interaction not needed.

While CVSS and EPSS scores are not available, the underlying risk is substantial. LFI vulnerabilities are consistently highly exploitable due to their low attack complexity—they typically require only network access and no authentication. The vulnerability affects WordPress plugin installations, which are ubiquitous targets. The fact that this is tagged as affecting information disclosure and being documented by a reputable source (Patchstack) with an EUVD identifier suggests active tracking by the security community. Without a CVSS vector or KEV status provided, the real-world priority depends on: (1) how widely The Aisle Core is installed, (2) whether a public proof-of-concept exists, and (3) patch availability. LFI vulnerabilities are typically automatable and can lead to significant technical impact (confidentiality breach). The absence of CVSS/EPSS data should not lower confidence—LFI in widely-used WordPress plugins historically receives high exploitation rates.

An unauthenticated attacker discovers the vulnerable endpoint in The Aisle Core plugin and crafts a request containing a file path traversal payload (e.g., a parameter set to '../../../../etc/passwd' or '../../../../wp-config.php'). The server processes this input without validation and includes the requested local file in the response, exposing the file contents to the attacker. In a typical WordPress scenario, the attacker retrieves wp-config.php to extract database credentials, then pivots to further compromise the site or underlying infrastructure. No special privileges or authentication are required, making this a straightforward attack with high success probability.