CVE-2026-27040

High

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0038 29.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-27040 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27040 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified under CWE-22, in the AA-Team WZone Woozone WordPress plugin. This issue affects WZone versions from n/a through 14.0.31 and was published on 2026-03-25.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. A low-privileged authenticated attacker can exploit it remotely with low complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability, including arbitrary file deletion.

The Patchstack advisory provides further details on this arbitrary file deletion vulnerability in the WZone plugin version 14.0.31: https://patchstack.com/database/Wordpress/Plugin/woozone/vulnerability/wordpress-wzone-plugin-14-0-31-arbitrary-file-deletion-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15758

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

Why these techniques?

Path traversal (CWE-22) directly enables authenticated arbitrary file deletion, mapping to T1070.004 (File Deletion under Indicator Removal) and T1485 (Data Destruction) for availability/integrity impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0