What is the CVSS score of CVE-2026-27079?

CVE-2026-27079 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-27079?

CVE-2026-27079 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-27079?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-27079

EUVD-2026-15785 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-xx6j-2vc6-x568

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15785

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows PHP Local File Inclusion.This issue affects Amfissa: from n/a through <= 1.1.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Mikado-Themes Amfissa WordPress theme through version 1.1, allowing attackers to improperly control filenames in PHP include/require statements. This vulnerability enables unauthorized information disclosure by reading arbitrary local files from the affected server. The issue stems from improper input validation on file inclusion parameters and affects all versions of Amfissa up to and including version 1.1.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when PHP applications use unsanitized user input directly in include(), require(), include_once(), or require_once() statements. The affected product is Mikado-Themes Amfissa (CPE: cpe:2.3:a:mikado-themes:amfissa:*:*:*:*:*:*:*:*), a WordPress theme component. The root cause involves inadequate input validation and filtering of file path parameters, allowing attackers to manipulate include statements to load arbitrary files from the server's filesystem. This is distinct from Remote File Inclusion (RFI) as noted in the title but represents Local File Inclusion (LFI) as confirmed by the tags and EUVD classification, meaning the attacker can only access files on the local server rather than remote URLs.

RemediationAI

Users of the Mikado-Themes Amfissa theme should immediately upgrade to a patched version beyond 1.1 if available from the vendor, or disable the theme until a security update is released. As a critical interim measure, implement Web Application Firewall (WAF) rules to detect and block common LFI attack patterns such as directory traversal sequences (../, ..\) and file inclusion keywords (php://, phar://, etc.) in URL parameters and POST data. Additionally, restrict file permissions on the WordPress installation directory to prevent unauthorized file access, ensure PHP display_errors is disabled in production environments, and consider moving sensitive configuration files outside the web root. Organizations should monitor the Patchstack security advisory at the reference URL for patch availability and vendor communications from Mikado-Themes. Until a patch is available and deployed, network segmentation and access controls limiting WordPress admin access to trusted IP ranges provide additional defense-in-depth protection.