CVE-2026-27991: 
WordPress vulnerability analysis and mitigation

CVE-2026-27991 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Avventure WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Avventure theme up to and including version 1.1.12, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by security researcher "Bonds" on October 4, 2025, and publicly disclosed on March 2–5, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The root cause is improper validation and sanitization of user-supplied input used to control filenames in PHP include/require statements (CWE-98), enabling PHP Local File Inclusion. An unauthenticated attacker can craft a malicious HTTP request that manipulates a filename parameter to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (AC:H) but no privileges or user interaction, and the scope remains unchanged. The vulnerability is tracked under CAPEC-193 (PHP Remote File Inclusion) and was assigned Patchstack ID c232cd6da7b5 (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the web server, potentially exposing sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, unauthorized access to application data, and potentially arbitrary code execution if the attacker can control file content (e.g., via log poisoning). The vulnerability carries high impact ratings across confidentiality, integrity, and availability (Patchstack, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Avventure theme (version ≤ 1.1.12) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme-related HTTP response headers and page source references to /wp-content/themes/avventure/.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion point — a parameter or request path that passes user-controlled input to a PHP include/require statement without adequate sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Retrieve sensitive data: If successful, the server returns the contents of the included file in the HTTP response, exposing credentials, configuration data, or other sensitive information.
5. Escalate (optional): Leverage exposed database credentials from wp-config.php for database access, or chain with log poisoning techniques to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies targeting the Avventure theme directory.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded traversal patterns or references to sensitive files like wp-config.php, /etc/passwd, or PHP log files from unauthenticated sources.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system files that do not correspond to legitimate administrative activity.
• Process: PHP error logs showing failed file inclusion attempts or warnings about invalid file paths originating from Avventure theme files.

As of the disclosure date, no official patch from ThemeREX is available for the Avventure theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended immediate actions include: (1) disabling or replacing the Avventure theme if possible; (2) deploying a Web Application Firewall (WAF) with rules blocking path traversal and file inclusion patterns; (3) restricting access to the WordPress installation at the network level; and (4) monitoring Patchstack and the ThemeREX vendor channel for an official patched version (Patchstack).

Wordfence included CVE-2026-27991 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of a broader set of theme-related vulnerabilities. Patchstack, the assigning CNA, classified it as high priority and noted the vulnerability class is commonly leveraged in mass-exploit campaigns against WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond these security vendor reports (Wordfence, Patchstack).