Is PHP affected by CVE-2026-27337?

A critical file inclusion vulnerability in the Chronicle WordPress theme (version 1.0 and earlier) could allow attackers to read sensitive files from affected websites, potentially exposing credentials, configuration data, and other confidential information.

CVE-2026-27337

Q: How to fix CVE-2026-27337?

Within 24 hours: Identify all WordPress installations using Chronicle theme <= 1.0 and document affected assets. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious file inclusion patterns, disable the Chronicle theme if business-critical functionality exists elsewhere, or restrict theme access via IP allowlisting. Within 30 days: Migrate to an alternative WordPress theme, monitor vendor communication for patch availability, and conduct a security audit of affected sites for evidence of compromise.

HIGH

2026-03-05 [email protected]

8.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Chronicle - Lifestyle Magazine & Blog WordPress Theme chronicle allows PHP Local File Inclusion.This issue affects Chronicle - Lifestyle Magazine & Blog WordPress Theme: from n/a through <= 1.0.

Analysis

The Chronicle WordPress theme version 1.0 and earlier contains a local file inclusion vulnerability in its PHP code that allows unauthenticated attackers to read arbitrary files from the affected server. An attacker can exploit this weakness to access sensitive configuration files, database credentials, or other confidential data stored on the web server. …

Remediation

Within 24 hours: Identify all WordPress installations using Chronicle theme <= 1.0 and document affected assets. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious file inclusion patterns, disable the Chronicle theme if business-critical functionality exists elsewhere, or restrict theme access via IP allowlisting. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +40

POC: 0

CVE-2026-27337 vulnerability details – vuln.today

Back

CVE-2026-27337

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-27337

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code