Pearl WordPress Theme CVE-2026-27412

Exploitation requires the target WordPress site to have the Pearl - Corporate Business theme (version ≤ 3.4.10) installed and active, and reachability of the specific theme endpoint/parameter that feeds the PHP include statement. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so any remote party who can reach the site over the network can attempt it. The principal limiting factor is the CVSS AC:H rating, which signals that a special condition beyond a trivial request - such as a particular encoding, path/wrapper form, or server configuration - must be met for reliable exploitation; the specific triggering parameter is not disclosed in the available data. Impact is bounded by PHP configuration (allow_url_include, open_basedir) which can constrain which local files are includable.

The signals are moderately strong but not top-tier urgent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1 High) indicates a network-reachable, unauthenticated flaw, which is a serious combination, but the AC:H metric materially lowers real-world exploitability by implying a non-trivial precondition or race/encoding hurdle rather than a trivial one-shot request. No EPSS probability was provided, so likelihood cannot be quantified from this data. The vulnerability is not on the CISA KEV list, and no proof-of-concept is referenced, so there is no evidence of active or automated exploitation. Note a tension in the vendor data: the tags label this 'Information Disclosure / LFI' (consistent with a read-only C:H impact), yet the official vector asserts I:H and A:H - for a pure LFI this is aggressive and likely reflects the theoretical include-to-execution ceiling of CWE-98 rather than confirmed integrity/availability impact; treat the I:H/A:H claims as unverified pending vendor detail. Overall this is a legitimate patch-soon item for sites running the Pearl theme, not a drop-everything emergency absent exploitation signals.

An unauthenticated attacker sends a crafted HTTP request to a Pearl-theme WordPress site, supplying a manipulated path or PHP stream wrapper to a parameter that reaches an include/require call, causing the server to disclose the contents of wp-config.php and leak database credentials and secret keys. The AC:H rating suggests success may depend on specific encoding, path conditions, or configuration, so exploitation is plausible but not a guaranteed single request; no public proof-of-concept is currently referenced.