CVE-2026-27341: 
WordPress vulnerability analysis and mitigation

CVE-2026-27341 is a PHP Local File Inclusion (LFI) vulnerability in the TopScorer - Sports WordPress Theme by Mikado-Themes, affecting versions 1.2 and earlier. The vulnerability stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 3, 2025, and published by Patchstack on February 25, 2026. It carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion attacks. An unauthenticated attacker can manipulate a filename parameter passed to a PHP include() or require() statement within the theme's code, causing the server to include and execute arbitrary local files. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting specific conditions or knowledge may be needed to reliably trigger the flaw. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the server, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, or other files accessible to the web server process. This can lead to full database compromise, credential theft, and potentially arbitrary code execution if attacker-controlled content (e.g., uploaded files) can be included. The overall impact spans high confidentiality, integrity, and availability consequences, threatening the entire WordPress installation and underlying server (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of active in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the TopScorer theme (version ≤ 1.2) via passive fingerprinting tools such as WhatCMS, BuiltWith, or by inspecting HTML source for theme-specific paths (e.g., /wp-content/themes/topscorer/).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or use fuzzing tools to locate endpoints where user-supplied input is passed to a PHP include() or require() function without proper sanitization.
3. Craft LFI payload: Construct an HTTP request targeting the vulnerable parameter with a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) to reference sensitive local files.
4. Send the request: Submit the crafted request to the vulnerable endpoint (unauthenticated) and observe the server response for file contents.
5. Escalate: If file upload functionality is available, upload a PHP web shell disguised as an allowed file type, then use the LFI to include and execute it, achieving remote code execution on the server (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests to TopScorer theme PHP files with suspicious parameter values referencing system files (e.g., wp-config.php, etc/passwd); repeated 200 responses to such requests may indicate successful inclusion.
• File System: Presence of unexpected PHP files or web shells in the WordPress uploads directory (/wp-content/uploads/) or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or network scanning tools.

As of the publication date, no official patch from Mikado-Themes is available for the TopScorer theme. Organizations should immediately disable or remove the theme if it is not actively required. If the theme must remain active, implement Web Application Firewall (WAF) rules to block path traversal and file inclusion attempts — Patchstack has issued a virtual patch/mitigation rule for its subscribers. Additional hardening steps include enforcing strict file permissions, disabling PHP execution in upload directories, and monitoring access logs for exploitation attempts. Users should check with Mikado-Themes for any forthcoming security updates and apply them promptly (Patchstack).

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, with Patchstack coordinating the disclosure and issuing a virtual mitigation rule in the absence of an official vendor patch. Patchstack classified it as high priority, noting that LFI vulnerabilities of this severity are commonly leveraged in mass WordPress exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).