CVE-2026-27065
Published: 19 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the PHP Local File Inclusion flaw in BuilderPress plugin versions through 2.0.1 via timely patching or removal.
Mandates validation of filenames used in PHP include/require statements to block malicious local file inclusion paths exploited in this vulnerability.
Enforces secure PHP configuration settings such as open_basedir restrictions and disabling dangerous include functions to limit the scope of local file inclusion attacks.
Security SummaryAI
CVE-2026-27065 is an Improper Control of Filename for Include/Require Statement vulnerability in the ThimPress BuilderPress WordPress plugin, enabling PHP Local File Inclusion. Despite the descriptor referencing PHP Remote File Inclusion, the issue specifically allows local file inclusion attacks. It affects BuilderPress versions from n/a through 2.0.1 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), linked to CWE-98.
Unauthenticated attackers with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary local file reads or execution of server-side code if attackers can manipulate include paths to sensitive or executable files.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/builderpress/vulnerability/wordpress-builderpress-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in BuilderPress version 2.0.1, providing details relevant to mitigation through plugin updates or removal.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote local file inclusion (LFI) in a public-facing WordPress plugin, enabling arbitrary local PHP file inclusion and execution, directly facilitating T1190: Exploit Public-Facing Application.