CVE-2026-27065: 
WordPress vulnerability analysis and mitigation

CVE-2026-27065 is a Local File Inclusion (LFI) vulnerability in the ThimPress BuilderPress WordPress plugin, affecting all versions up to and including 2.0.1. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported by researcher Phat RiO on December 12, 2025, and published by Patchstack on March 12, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), requiring no privileges or user interaction (Patchstack, EUVD).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly referred to as PHP Remote File Inclusion, though in this case it manifests as Local File Inclusion. The root cause is insufficient validation or sanitization of user-supplied input that is passed directly to PHP's include or require constructs within the BuilderPress plugin. An unauthenticated attacker can craft a malicious HTTP request with a manipulated filename parameter to force the server to include arbitrary local files, potentially exposing their contents. No authentication or special privileges are required, and exploitation is achievable over the network with low attack complexity (Patchstack, EUVD).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This can lead to complete database takeover, exposure of secret keys, and potential escalation to remote code execution if the attacker can chain the LFI with file upload or log poisoning techniques. The vulnerability affects confidentiality, integrity, and availability at a high level, and could serve as an initial foothold for broader compromise of the WordPress environment and underlying server (Patchstack).

No official patch was available at the time of disclosure, increasing the risk of exploitation. Patchstack has flagged this vulnerability as highly dangerous and expected to be used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity. The EPSS score is approximately 0.0015 (0.15%), indicating a currently low but non-negligible probability of exploitation in the near term. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported, and the vulnerability does not appear in the CISA KEV catalog as of the time of this report (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the BuilderPress plugin (version ≤ 2.0.1) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/builderpress/.
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or public disclosures to locate the endpoint and parameter that passes user input to a PHP include or require statement without proper sanitization.
3. Craft malicious request: Construct an HTTP GET or POST request targeting the vulnerable endpoint, injecting a path traversal payload (e.g., ../../../../wp-config.php) into the filename parameter.
4. Retrieve sensitive files: Send the crafted request to the target server; if successful, the server will include and output the contents of the specified local file (e.g., wp-config.php exposing database credentials).
5. Escalate access: Use extracted credentials to access the WordPress database directly, create admin accounts, or chain with other vulnerabilities (e.g., log poisoning via PHP session files) to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to WordPress endpoints associated with the BuilderPress plugin containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal patterns targeting BuilderPress plugin endpoints; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files as reflected in server-side file access logs.
• Process: PHP error logs showing file inclusion warnings or unexpected file read operations initiated by the web server process.

As of the time of disclosure, no official patch from ThimPress was available for BuilderPress versions ≤ 2.0.1. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators should monitor the BuilderPress plugin page for an updated version and apply it immediately upon release. As interim measures, consider disabling the BuilderPress plugin if it is not critical, restricting access to WordPress plugin endpoints via web application firewall (WAF) rules, and ensuring the web server user has minimal file system permissions (Patchstack).

The vulnerability received coverage from security aggregators and community platforms shortly after disclosure, including posts on Mastodon and Bluesky highlighting the critical CVSS score. Wordfence included it in their weekly WordPress vulnerability report for the week of March 9–15, 2026. The Hacker Wire published a dedicated article on the vulnerability, and INCIBE (Spain's national cybersecurity agency) issued an early warning alert (Wordfence, The Hacker Wire, INCIBE).