CVE-2026-27075: 
WordPress vulnerability analysis and mitigation

CVE-2026-27075 is a Local File Inclusion (LFI) vulnerability in the Mikado-Themes Belfort WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects Belfort versions up to and including 1.0, and was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 10, 2025, with public disclosure on March 10–25, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers with high attack complexity (Patchstack, Feedly).

The root cause is improper validation and sanitization of filename parameters passed to PHP include/require statements within the Belfort theme (CWE-98). An unauthenticated remote attacker can manipulate these parameters to force the server to include arbitrary local files, potentially exposing their contents or executing embedded PHP code. No authentication or user interaction is required, though the attack complexity is rated High, suggesting specific conditions or non-default configurations may need to be met. No public proof-of-concept or detailed technical write-up has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to include and render arbitrary local files from the server, which can expose sensitive data such as database credentials (e.g., wp-config.php), configuration files, or other sensitive WordPress files. Depending on server configuration, this could escalate to remote code execution if attacker-controlled content (e.g., uploaded files containing PHP) is included. The vulnerability has HIGH impact on confidentiality, integrity, and availability, potentially enabling complete compromise of the affected WordPress site and its underlying database (Patchstack).

There is currently no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the near term. No threat actor attribution has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with unauthenticated access) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Belfort theme version 1.0 or earlier via tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/belfort).
2. Identify vulnerable parameter: Analyze the Belfort theme's PHP source code or HTTP responses to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's response for the contents of the included file, which may contain database credentials, secret keys, or other sensitive configuration data.
5. Escalate if possible: If the server allows inclusion of uploaded files (e.g., images with embedded PHP), attempt to include a previously uploaded file to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to Belfort theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or form fields.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server configuration files by the web server process.
• Process: PHP processes reading files outside the expected WordPress directory tree, particularly sensitive system or configuration files.

Update the Belfort theme to version 1.2 or later, which contains the patch for this vulnerability (Patchstack). If an immediate update is not possible, implement input validation and sanitization for all filename parameters used in PHP include/require statements, and restrict file inclusion to a whitelist of allowed files. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until the theme is updated. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns is recommended as a compensating control.

Patchstack, which coordinated the disclosure, classified this as a high-priority vulnerability and issued a mitigation rule for its users, noting that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). Wordfence referenced the vulnerability in its weekly WordPress vulnerability report for the week of March 9–15, 2026. No significant broader media coverage or notable researcher commentary beyond these sources has been identified.