What is the CVSS score of CVE-2026-27412?

CVE-2026-27412 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Pearl WordPress Theme are affected by CVE-2026-27412?

Organizations running the Pearl WordPress theme (versions 3.4.10 or earlier) face immediate exposure of sensitive credentials and configuration data to external attackers, creating direct risk of…

How to fix or mitigate CVE-2026-27412?

24 hours: Audit all WordPress installations to identify use of Pearl theme version 3.4.10 or earlier; document affected sites and infrastructure. 7 days: Implement Web Application Firewall rules to block path traversal attack patterns; apply restrictive file permissions to sensitive configuration files; disable or replace the vulnerable theme if operationally feasible. 30 days: Monitor vendor advisory channels (Patchstack, StyleMixThemes) for patch announcements; test and deploy patches immediately upon availability; review server access logs for any exploitation attempts.

Pearl WordPress Theme CVE-2026-27412

EUVD-2026-41331 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-02 Patchstack

GHSA-94cf-x5cw-j37q

PHP WordPress Information Disclosure LFI Pearl Corporate Business Wordpress Theme Stylemixthemes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Unauthenticated network LFI (AV:N/PR:N) with AC:H per vendor precondition; assessed as read-only information disclosure so C:H but I:N/A:N absent confirmed code-execution or file-write.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:10 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

AnalysisAI

Local File Inclusion in the Pearl - Corporate Business WordPress theme (StyleMixThemes) versions 3.4.10 and earlier lets unauthenticated remote attackers coerce the application into including arbitrary local files, exposing sensitive server-side content such as configuration files and credentials. Rated CVSS 8.1 by Patchstack, the flaw requires no authentication (PR:N) but carries high attack complexity (AC:H), and depending on include handling could escalate from information disclosure toward code execution. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.

Technical ContextAI

The affected component is a commercial WordPress theme, Pearl - Corporate Business, authored by StyleMixThemes (CPE cpe:2.3:a:stylemixthemes:pearl_-_corporate_business). The root cause maps to CWE-98, Improper Control of Filename for Include/Require Statement in a PHP Program - the classic PHP file-inclusion weakness where user-influenced input flows into an include(), require(), or equivalent statement without adequate validation or path canonicalization. In WordPress themes this typically arises from AJAX handlers, template loaders, or shortcode/parameter processing that build a filesystem path from a request parameter. Because PHP's include family both reads and can execute included content, this weakness class straddles pure information disclosure (reading /wp-config.php, /etc/passwd, log files) and, where an attacker can plant or reference includable PHP, remote code execution.

RemediationAI

No vendor-released patched version is identified in the provided data, so the specific fixed release cannot be cited with confidence - administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/pearl/vulnerability/wordpress-pearl-corporate-business-theme-3-4-10-local-file-inclusion-vulnerability) and the StyleMixThemes changelog for a version newer than 3.4.10 and upgrade to it as the primary fix. Until a confirmed patched build is applied, compensating controls include deploying a WAF or Patchstack virtual patch to block file-inclusion payloads (path traversal sequences like ../ and PHP wrappers such as php://filter and data:// against the theme's request parameters), hardening PHP by setting allow_url_include=Off and constraining open_basedir to the WordPress docroot so includes cannot reach sensitive files like /etc/passwd or /wp-config.php outside the web root (side effect: may break legitimate plugins that read outside the docroot), and restricting or disabling the vulnerable theme AJAX/endpoint if it can be identified. Where feasible, switching to a different maintained theme eliminates the exposure at the cost of site rework.