What is the CVSS score of CVE-2026-27075?

CVE-2026-27075 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27075?

CVE-2026-27075 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27075?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27075

EUVD-2026-15777 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15777

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Belfort belfort allows PHP Local File Inclusion.This issue affects Belfort: from n/a through <= 1.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Mikado-Themes Belfort WordPress theme version 1.0 and earlier, allowing attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. While classified as a Remote File Inclusion vulnerability in the CVE description, the actual impact is Local File Inclusion, enabling information disclosure through the reading of sensitive files such as configuration files, database credentials, and source code. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability's nature suggests moderate to high real-world risk given the prevalence of WordPress themes and the ease of exploitation.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a fundamental input validation flaw in PHP applications. The affected product, Mikado-Themes Belfort (identified via CPE cpe:2.3:a:mikado-themes:belfort:*:*:*:*:*:*:*:*), likely accepts user-controlled input through GET, POST, or other parameters that are directly passed to PHP's include(), require(), include_once(), or require_once() functions without adequate sanitization or validation. Attackers can exploit this by manipulating file path parameters to reference local files on the server (such as /etc/passwd on Linux systems or configuration files in the WordPress directory structure), causing the PHP interpreter to read and potentially execute these files. The vulnerability affects the theme across all versions through 1.0, suggesting it may have been present since the theme's initial release.

RemediationAI

The primary remediation step is to immediately deactivate and remove the Mikado-Themes Belfort theme from affected WordPress installations, replacing it with an alternative, actively maintained WordPress theme from a reputable source. If switching themes is not immediately feasible, implement a temporary Web Application Firewall (WAF) rule on your reverse proxy or WordPress security plugin to block requests containing suspicious file path traversal patterns (such as sequences containing ../, /etc/, or other path traversal indicators) in all query parameters and POST bodies. Additionally, implement file access restrictions at the web server level (Apache .htaccess or Nginx configuration) to prevent direct access to sensitive WordPress configuration files (wp-config.php). Enable WordPress file integrity monitoring to detect unauthorized file inclusions or modifications. Until the theme is removed, ensure WordPress and all plugins are fully patched, and apply principle of least privilege to file system permissions. Contact Mikado-Themes through their website (patchstack.com documentation) or directly to inquire about a security patch; if no patch is forthcoming, permanent removal of the theme is the only reliable solution.