CVE-2026-27097: 
WordPress vulnerability analysis and mitigation

CVE-2026-27097 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes CasaMia | Property Rental Real Estate WordPress Theme. Classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), it affects all versions of the theme through 1.1.2. The vulnerability was published on March 5, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The vulnerability stems from improper validation of user-supplied input used in PHP include/require statements within the CasaMia theme (CWE-98). An attacker can manipulate filename parameters to cause the PHP interpreter to include arbitrary files from the server's filesystem, enabling local file inclusion (LFI). Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting specific conditions or knowledge of the target environment are needed. A GitHub repository referencing the CVE (potentially containing PoC code) was observed shortly after disclosure (Feedly, Wordfence).

Successful exploitation allows an attacker to include and execute arbitrary files from the server, potentially exposing sensitive configuration files (e.g., wp-config.php), credentials, and other server-side data. In scenarios where file upload functionality exists or can be chained with other vulnerabilities, LFI can escalate to remote code execution, leading to full compromise of the WordPress installation. This could result in data theft, website defacement, malware installation, and lateral movement within the shared hosting environment (Feedly).

As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no public proof-of-concept has been officially verified. However, a GitHub repository named hacker1337itme/CVE-2026-27097 appeared shortly after disclosure, suggesting potential PoC availability. The EPSS score is approximately 0.053% (0.000530), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been made (Feedly).

1. Reconnaissance: Identify WordPress sites using the CasaMia theme (version ≤ 1.1.2) via passive techniques such as checking theme metadata in page source (/wp-content/themes/casamia/style.css) or using tools like WPScan.
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that accept user-controlled input for file inclusion (e.g., a template or page parameter passed via GET/POST request).
3. Craft LFI payload: Construct a request with a path traversal payload targeting sensitive files, such as ../../../../wp-config.php or /etc/passwd, injected into the vulnerable parameter.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site (e.g., https://target.com/?vulnerable_param=../../../../wp-config.php).
5. Extract sensitive data or escalate: Review the server response for included file contents. If a writable upload directory exists and a PHP file has been previously uploaded, chain the LFI to achieve remote code execution by including the uploaded file (Feedly).

• Network: Unusual HTTP GET/POST requests to WordPress pages with path traversal sequences (../, ..%2F, %2e%2e%2f) in query parameters; requests returning unexpected file contents (e.g., PHP configuration data).
• Logs: WordPress/Apache/Nginx access logs showing requests with encoded path traversal strings targeting theme-related endpoints; PHP error logs referencing failed file inclusion attempts with suspicious paths.
• File System: Unexpected PHP files in the uploads directory (/wp-content/uploads/) that could be used for LFI-to-RCE chaining; modified theme files in /wp-content/themes/casamia/.
• Process: Unusual PHP child processes spawned by the web server user; unexpected outbound connections from the web server process.

Users should immediately update the CasaMia theme to a version above 1.1.2 if a patched release is available from AncoraThemes. If no patch is available, the recommended interim measure is to deactivate or remove the theme and switch to a secure alternative until a fix is released. Deploying a Web Application Firewall (WAF) with rules targeting path traversal and file inclusion patterns (e.g., Wordfence, Cloudflare WAF) can provide additional protection. Server-level hardening measures include restricting PHP's open_basedir directive and disabling allow_url_include in php.ini (Feedly, Wordfence).

Wordfence included CVE-2026-27097 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of theme-related vulnerabilities. The CVE was also noted in automated feeds such as CVEnew on social platforms. No significant vendor statement from AncoraThemes or broader media coverage has been identified at this time (Wordfence).