CVE-2026-27997: 
WordPress vulnerability analysis and mitigation

CVE-2026-27997 is a Local File Inclusion (LFI) vulnerability in the ThemeREX Maxify WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Maxify theme up to and including version 1.0.16. The vulnerability was reported by security researcher "Bonds" on October 4, 2025, and publicly disclosed on March 5, 2026, via Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), assessed by CISA-ADP (Patchstack, Wordfence).

The vulnerability stems from improper handling of filename parameters used in PHP include/require statements within the ThemeREX Maxify theme (CWE-98). An unauthenticated remote attacker can manipulate filename-based input parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). The vulnerability was discovered and reported to Patchstack, which issued a virtual patch/mitigation rule while no official vendor patch is available (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability has high impact on confidentiality, integrity, and availability of the affected system. In worst-case scenarios, if combined with a file upload vulnerability or other writable path, LFI can escalate to remote code execution (Patchstack).

As of the disclosure date, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic size or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeREX Maxify theme version 1.0.16 or earlier using tools like WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters that are passed directly to PHP include/require statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) targeting the vulnerable parameter with a path traversal payload (e.g., ../../../../wp-config.php) to reference a sensitive local file.
4. Retrieve sensitive data: Submit the crafted request to the target WordPress site; if successful, the server will include and output the contents of the targeted file (e.g., database credentials from wp-config.php).
5. Escalate access: Use retrieved credentials or other sensitive information to gain further access to the database, admin panel, or other server resources (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body targeting the Maxify theme endpoints.
• Logs: Web server access logs showing requests with encoded path traversal patterns or references to sensitive files like wp-config.php, /etc/passwd, or other system files in parameter values.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system configuration files that correlate with suspicious web requests.
• Process: PHP error logs showing failed file inclusion attempts or warnings about invalid file paths originating from Maxify theme files.

No official patch from ThemeREX is currently available for the Maxify theme. Patchstack has issued a virtual mitigation rule for its subscribers to block exploitation attempts until an official patch is released. Recommended interim mitigations include: (1) deploying a Web Application Firewall (WAF) with rules to detect and block path traversal and LFI attempts; (2) disabling the Maxify theme if it is not essential; (3) ensuring PHP's allow_url_include directive is disabled in php.ini; and (4) implementing strict input validation and whitelisting for any filename-based includes at the server or application level. Organizations should monitor the ThemeREX and Patchstack advisories for an official patched version (Patchstack).

Wordfence included CVE-2026-27997 in its weekly WordPress vulnerability report for the period of March 2–8, 2026, highlighting it as part of broader WordPress ecosystem security monitoring (Wordfence). Patchstack, which discovered and disclosed the vulnerability, emphasized the high-severity risk and the potential for mass exploitation campaigns targeting WordPress sites using this theme class of vulnerability (Patchstack). No significant broader media coverage or notable researcher commentary beyond these sources has been identified.