What is the CVSS score of CVE-2026-27048?

CVE-2026-27048 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27048?

CVE-2026-27048 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27048?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27048

EUVD-2026-15765 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-ph5g-qjp4-x7h4

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15765

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle Core theaisle-core allows PHP Local File Inclusion.This issue affects The Aisle Core: from n/a through <= 2.0.5.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in Elated-Themes' The Aisle Core WordPress plugin through version 2.0.5, stemming from improper control of filenames in PHP include/require statements. This vulnerability allows unauthenticated attackers to read arbitrary files from the affected server, potentially exposing sensitive configuration files, database credentials, and other confidential information. No CVSS score, EPSS data, or active KEV status is currently available, but the vulnerability has been publicly documented by Patchstack and assigned EUVD-2026-15765.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when a PHP application fails to properly sanitize or validate user-supplied input before passing it to PHP's include() or require() functions. The Aisle Core plugin (CPE: cpe:2.3:a:elated-themes:the_aisle_core:*:*:*:*:*:*:*:*) is a WordPress theme component that presumably accepts file path parameters without adequate validation, enabling attackers to traverse the filesystem and include arbitrary files. This is distinct from Remote File Inclusion (RFI) in that it targets local files only, but the impact can be equally severe as it may expose source code, configuration files containing database credentials, and other sensitive data stored on the server.

RemediationAI

Users of The Aisle Core plugin should immediately upgrade to a patched version released after 2.0.5 (contact Elated-Themes or check their official repository for availability). Until a patch is available, consider temporarily deactivating the plugin if it is not mission-critical. As a compensatory control, restrict access to the WordPress installation via Web Application Firewall (WAF) rules that block suspicious file inclusion attempts (e.g., requests containing '../' sequences or protocol wrappers like 'php://'). Additionally, harden the WordPress environment by limiting file and directory permissions to prevent unauthorized reads, and monitor logs for unusual file access patterns. For detailed mitigation guidance, refer to the Patchstack advisory linked in references.