What is the CVSS score of EUVD-2026-15787?

EUVD-2026-15787 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15787?

CVE-2026-27080 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate EUVD-2026-15787?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-15787

| CVE-2026-27080 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-87q2-33j6-73vw

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15787

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Deston deston allows PHP Local File Inclusion.This issue affects Deston: from n/a through <= 1.0.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Mikado-Themes Deston WordPress theme through version 1.0, allowing attackers to read arbitrary files from the server filesystem via improper control of filename parameters in PHP include/require statements. This vulnerability, classified as CWE-98 (PHP Remote File Inclusion), enables information disclosure attacks where sensitive files such as configuration files, database credentials, or source code could be exposed. The vulnerability affects all versions of Deston up to and including 1.0, and has been documented by Patchstack with an EUVD ID (EUVD-2026-15787), though CVSS scoring and KEV status are not yet available.

Technical ContextAI

The vulnerability stems from improper input validation in PHP include or require statements within the Deston theme codebase. The root cause, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), occurs when user-supplied input is directly concatenated into file inclusion functions without sanitization or path restriction. This allows attackers to traverse the filesystem using directory traversal sequences (e.g., '../../../etc/passwd') or, in some cases, include remote files if PHP's allow_url_include directive is enabled. The affected product is identified via CPE cpe:2.3:a:mikado-themes:deston:*:*:*:*:*:*:*:*, indicating all versions of the Deston WordPress theme are potentially vulnerable. The vulnerability is tagged as both LFI (Local File Inclusion) and Information Disclosure, confirming the primary impact is unauthorized file access rather than remote code execution.

RemediationAI

Mikado-Themes should be contacted to obtain or release a patched version of the Deston theme addressing the LFI vulnerability; until such a patch is available, users should immediately disable or remove the Deston theme from production WordPress installations and replace it with an alternative theme. As a temporary mitigation if theme replacement is not immediately feasible, implement Web Application Firewall (WAF) rules to block requests containing directory traversal sequences ('../', '..\') in URL parameters and POST data, and restrict PHP's allow_url_include and allow_url_fopen directives to 'Off' in php.ini to prevent remote file inclusion. Additionally, implement strict input validation and file path whitelisting at the web server level using mod_rewrite or similar mechanisms to prevent arbitrary file access. Monitor the Patchstack vulnerability database and official Mikado-Themes channels for patch availability and apply updates immediately upon release. Until full remediation is possible, enforce principle of least privilege by running WordPress with minimal file permissions and regularly audit file access logs for suspicious inclusion patterns.