What is the CVSS score of CVE-2026-27065?

CVE-2026-27065 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27065?

BuilderPress WordPress plugin versions through 2.0.1 contain a critical vulnerability (CVSS 9.8) allowing unauthenticated attackers to read arbitrary files from affected servers without requiring…

How to fix or mitigate CVE-2026-27065?

Within 24 hours: Identify all WordPress installations using BuilderPress plugin and document affected systems. Within 7 days: Disable or remove the BuilderPress plugin from all production environments; if operationally critical, implement network-level access controls (see compensating controls). Within 30 days: Monitor vendor advisories for patch availability; coordinate with plugin developers on remediation timeline and evaluate alternative plugins for required functionality.

PHP CVE-2026-27065

EUVD-2026-13085 CRITICAL

PHP Remote File Inclusion (CWE-98)

2026-03-19 audit@patchstack.com

PHP Information Disclosure LFI

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 09:22 euvd

EUVD-2026-13085

Analysis Generated

Mar 19, 2026 - 09:22 vuln.today

CVE Published

Mar 19, 2026 - 09:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through 2.0.1.

AnalysisAI

ThimPress BuilderPress, a WordPress plugin, contains a Local File Inclusion vulnerability through improper filename control in PHP include/require statements that allows unauthenticated remote attackers to read arbitrary files from the server. All versions through 2.0.1 are affected. With a CVSS score of 9.8 (Critical) and no authentication required, this represents a severe vulnerability allowing unauthorized information disclosure, though EPSS and KEV status data are not provided in the intelligence sources.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote File Inclusion, though the description indicates it allows PHP Local File Inclusion in practice. The flaw occurs when user-controlled input is passed to PHP include() or require() functions without proper validation or sanitization, allowing attackers to manipulate file paths to include arbitrary local files. BuilderPress is a WordPress plugin by ThimPress, and the vulnerability affects versions from the initial release through version 2.0.1. The vulnerability is categorized with PHP and LFI tags, indicating the attack vector exploits PHP's file inclusion mechanisms to traverse the filesystem and access sensitive files outside the intended directory structure.

RemediationAI

Users of BuilderPress should immediately upgrade to a version newer than 2.0.1 that addresses this Local File Inclusion vulnerability. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/builderpress/vulnerability/wordpress-builderpress-plugin-2-0-1-local-file-inclusion-vulnerability for specific patched version information and vendor guidance. If an immediate upgrade is not feasible, temporarily disable the BuilderPress plugin until patching can be completed. Additionally, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, %2e%2e%2f) and monitor server logs for suspicious file access attempts. Review file permissions on the WordPress installation to ensure sensitive configuration files have restricted access, and consider implementing PHP disable_functions directives to limit the impact of file inclusion vulnerabilities.