CVE-2026-27065
Published: 19 March 2026
Summary
CVE-2026-27065 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27065 is an Improper Control of Filename for Include/Require Statement vulnerability in the ThimPress BuilderPress WordPress plugin, enabling PHP Local File Inclusion. Despite the descriptor referencing PHP Remote File Inclusion, the issue specifically allows local file inclusion attacks. It affects BuilderPress versions from n/a through 2.0.1 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), linked to CWE-98.
Unauthenticated attackers with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary local file reads or execution of server-side code if attackers can manipulate include paths to sensitive or executable files.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/builderpress/vulnerability/wordpress-builderpress-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in BuilderPress version 2.0.1, providing details relevant to mitigation through plugin updates or removal.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13085
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote local file inclusion (LFI) in a public-facing WordPress plugin, enabling arbitrary local PHP file inclusion and execution, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the PHP Local File Inclusion flaw in BuilderPress plugin versions through 2.0.1 via timely patching or removal.
Mandates validation of filenames used in PHP include/require statements to block malicious local file inclusion paths exploited in this vulnerability.
Enforces secure PHP configuration settings such as open_basedir restrictions and disabling dangerous include functions to limit the scope of local file inclusion attacks.