What is the CVSS score of CVE-2026-27076?

CVE-2026-27076 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27076?

CVE-2026-27076 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27076?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27076

EUVD-2026-15779 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15779

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allows PHP Local File Inclusion.This issue affects LuxeDrive: from n/a through <= 1.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Mikado-Themes LuxeDrive WordPress theme (version 1.0 and earlier) that allows attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. An unauthenticated attacker can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, or other system files without requiring special privileges or user interaction. While no CVSS score or EPSS data is currently available, the vulnerability class (CWE-98: Improper Control of Filename for Include/Require Statement) indicates a high-severity condition with straightforward exploitation mechanics.

Technical ContextAI

This vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a well-documented class of file inclusion flaws affecting PHP applications. The root cause involves insufficient input validation on user-supplied parameters that are passed directly to PHP's include(), require(), include_once(), or require_once() functions without proper sanitization or allowlisting. The affected product is the LuxeDrive theme (identified via CPE cpe:2.3:a:mikado-themes:luxedrive:*:*:*:*:*:*:*:*), a WordPress theme distributed by Mikado-Themes. Unlike Remote File Inclusion (RFI), Local File Inclusion (LFI) restricts an attacker to files accessible on the target server's filesystem, but can still lead to severe information disclosure, execution of uploaded files, or log file poisoning attacks in certain configurations.

RemediationAI

The primary remediation step is to upgrade the LuxeDrive theme to a patched version released by Mikado-Themes after version 1.0 (contact the vendor for availability and timeline). Until a patch is available, disable or remove the LuxeDrive theme from production environments and replace it with an alternative theme known to be secure. As a temporary mitigation, implement a Web Application Firewall (WAF) rule to block requests containing common LFI path traversal patterns (such as ../, ..\, or null byte sequences) targeting the vulnerable theme's endpoints. Additionally, restrict file system permissions to limit the scope of files readable by the web server process, and monitor access logs for suspicious patterns indicative of file inclusion attacks. Ensure the WordPress installation, all plugins, and remaining themes are kept up-to-date with security patches. Refer to the Patchstack advisory and contact Mikado-Themes support for official guidance on patch availability.