What is the CVSS score of EUVD-2026-15789?

EUVD-2026-15789 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15789?

CVE-2026-27081 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate EUVD-2026-15789?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP EUVD-2026-15789

| CVE-2026-27081 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15789

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows PHP Local File Inclusion.This issue affects Rosebud: from n/a through <= 1.4.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Mikado-Themes Rosebud WordPress theme through version 1.4, allowing attackers to include and execute arbitrary local files on the server via improper control of filename parameters in PHP include/require statements. This vulnerability enables information disclosure and potential remote code execution by reading sensitive files or including PHP files from the web root. No active exploitation in the wild has been publicly confirmed, but the vulnerability affects all installations of Rosebud up to and including version 1.4.

Technical ContextAI

The vulnerability stems from a CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) weakness in the Rosebud theme codebase. The underlying issue involves PHP's include() or require() functions being called with unsanitized user-controlled input, allowing path traversal and local file inclusion attacks. The affected product is identified via CPE as cpe:2.3:a:mikado-themes:rosebud:*:*:*:*:*:*:*:*, confirming this is a WordPress theme vulnerability rather than a core WordPress or plugin issue. Attackers can manipulate filename parameters (likely via GET/POST requests or URL manipulation) to specify arbitrary file paths, enabling them to read configuration files, source code, or execute malicious PHP scripts already present on the server.

RemediationAI

Immediately upgrade the Rosebud theme to a patched version released after 1.4 (exact version number should be verified with Mikado-Themes). Users should navigate to their WordPress dashboard, go to Appearance > Themes, locate Rosebud, and apply the available update. As an interim workaround if an immediate update is unavailable, disable the Rosebud theme and use an alternative theme until a patch is confirmed available. Additionally, review access logs for evidence of exploitation attempts targeting common inclusion patterns (../../../etc/passwd, wp-config.php, etc.) and verify the integrity of wp-config.php and other sensitive files for unauthorized modifications. For environments with multiple WordPress sites, prioritize patching any sites using Rosebud immediately given the public nature of this disclosure.