CVE-2026-27077: 
WordPress vulnerability analysis and mitigation

CVE-2026-27077 is a Local File Inclusion (LFI) vulnerability in the Mikado-Themes MultiOffice WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects MultiOffice versions up to and including 1.2, and was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, reported on December 10, 2025, and published on March 25, 2026. No official patch is currently available. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The root cause is improper validation and control of filenames used in PHP include/require statements within the MultiOffice theme (CWE-98), which allows user-supplied input to influence which local files are included by the PHP interpreter. An unauthenticated, remote attacker can craft a malicious network request with a manipulated file path parameter to trigger inclusion of arbitrary local files on the server. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or non-trivial exploitation step is involved. The vulnerability is classified under OWASP Top 10 A3: Injection and CAPEC-193 (PHP Remote File Inclusion) (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php), database credentials, source code, and other confidential information. Depending on server configuration (e.g., PHP wrappers or log poisoning opportunities), the LFI could be escalated to remote code execution, leading to full server compromise. The CVSS v3.1 score reflects High impacts across confidentiality, integrity, and availability (Patchstack, Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the MultiOffice theme (version ≤ 1.2) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP code or use fuzzing tools to locate parameters passed to PHP include/require statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request with a manipulated file path parameter (e.g., using path traversal sequences like ../../) targeting a sensitive file such as /etc/passwd or wp-config.php.
4. Send request: Submit the crafted request to the vulnerable WordPress endpoint without any authentication.
5. Retrieve file contents: If successful, the server response will contain the contents of the included local file, exposing credentials or other sensitive data.
6. Escalate (optional): If server conditions allow (e.g., PHP session files, access logs are readable), attempt log poisoning or PHP filter chain techniques to escalate LFI to remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or PHP wrapper strings (e.g., php://filter, file://) in parameter values.
• Logs: Web server access logs showing requests with encoded traversal patterns targeting theme-related PHP files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process.
• Process: PHP processes reading files outside the WordPress web root, or spawning unexpected child processes if LFI is escalated to RCE.

No official patch from Mikado-Themes is currently available for MultiOffice theme version 1.2 or earlier. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended interim mitigations include: deploying a Web Application Firewall (WAF) with rules to block path traversal and file inclusion patterns; restricting PHP file system permissions to limit accessible directories; disabling or isolating affected WordPress installations if risk is unacceptable; and monitoring for updates from Mikado-Themes. Site owners should also consider replacing the theme with a supported alternative if no patch is forthcoming (Patchstack).

The vulnerability was reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and disclosed through Patchstack's coordinated disclosure process. Wordfence referenced the vulnerability in its weekly WordPress vulnerability report for the week of March 9–15, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Wordfence, Patchstack).