Cyber Posture

CVE-2026-27065

Critical

Published: 19 March 2026

Published
19 March 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires identification, reporting, and correction of the PHP Local File Inclusion flaw in BuilderPress plugin versions through 2.0.1 via timely patching or removal.

prevent

Mandates validation of filenames used in PHP include/require statements to block malicious local file inclusion paths exploited in this vulnerability.

prevent

Enforces secure PHP configuration settings such as open_basedir restrictions and disabling dangerous include functions to limit the scope of local file inclusion attacks.

Security SummaryAI

CVE-2026-27065 is an Improper Control of Filename for Include/Require Statement vulnerability in the ThimPress BuilderPress WordPress plugin, enabling PHP Local File Inclusion. Despite the descriptor referencing PHP Remote File Inclusion, the issue specifically allows local file inclusion attacks. It affects BuilderPress versions from n/a through 2.0.1 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), linked to CWE-98.

Unauthenticated attackers with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary local file reads or execution of server-side code if attackers can manipulate include paths to sensitive or executable files.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/builderpress/vulnerability/wordpress-builderpress-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in BuilderPress version 2.0.1, providing details relevant to mitigation through plugin updates or removal.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an unauthenticated remote local file inclusion (LFI) in a public-facing WordPress plugin, enabling arbitrary local PHP file inclusion and execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References