What is the CVSS score of CVE-2026-27077?

CVE-2026-27077 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27077?

CVE-2026-27077 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27077?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27077

EUVD-2026-15781 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-4jcj-w79x-m6w6

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15781

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes MultiOffice multioffice allows PHP Local File Inclusion.This issue affects MultiOffice: from n/a through <= 1.2.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in Mikado-Themes' MultiOffice WordPress theme versions up to and including 1.2, stemming from improper control of filenames in PHP include/require statements. An attacker can exploit this vulnerability to read arbitrary files from the affected server, potentially disclosing sensitive configuration files, database credentials, or other confidential information. No CVSS score, EPSS data, or active exploitation (KEV) status has been assigned to this vulnerability.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes a failure to properly validate or sanitize user-supplied input before passing it to PHP file inclusion functions such as include(), require(), include_once(), or require_once(). The MultiOffice theme (CPE: cpe:2.3:a:mikado-themes:multioffice:*:*:*:*:*:*:*:*) uses unvalidated parameters in file inclusion logic, allowing attackers to manipulate the filename path to traverse the filesystem and include arbitrary local files. This is distinct from Remote File Inclusion (RFI) because it is limited to local filesystem access, though the impact remains significant for information disclosure.

RemediationAI

Immediately upgrade the MultiOffice theme to a version newer than 1.2 if available from Mikado-Themes; check the official Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/multioffice/vulnerability/wordpress-multioffice-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve for the latest patched version. If an immediate patch is unavailable, disable or remove the MultiOffice theme from production WordPress installations until a fixed version is released. As a temporary mitigation, restrict direct access to the theme's include directories via web server configuration (.htaccess or nginx rules) and implement input validation at the application layer to sanitize any user-supplied parameters used in file operations. Monitor WordPress security advisories and the Patchstack database for patch availability.