CVE-2026-27326
Published: 05 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme window-ac-services allows PHP Local File Inclusion.This issue affects AC Services | HVAC,…
more
Air Conditioning & Heating Company WordPress Theme: from n/a through <= 1.2.5.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of information inputs, directly preventing improper filename control in PHP include/require statements that enable local file inclusion.
SI-2 requires timely identification, reporting, and correction of system flaws, such as patching the vulnerable WordPress theme to remediate the LFI vulnerability.
CM-6 establishes and enforces secure configuration settings like PHP open_basedir restrictions to limit arbitrary local file access exploited by LFI.
Security SummaryAI
CVE-2026-27326 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and enabling PHP Local File Inclusion (LFI), in the AC Services | HVAC, Air Conditioning & Heating Company WordPress theme (slug: window-ac-services) developed by axiomthemes. The issue affects all versions from n/a through 1.2.5 and was published on 2026-03-05.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely by unauthenticated attackers (no privileges required) over the network, though with high attack complexity and no user interaction needed. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing attackers to include and potentially execute arbitrary local files on the server.
Mitigation guidance is provided in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/window-ac-services/vulnerability/wordpress-ac-services-hvac-air-conditioning-heating-company-wordpress-theme-theme-1-2-5-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote Local File Inclusion in a public-facing WordPress theme, allowing execution of arbitrary local PHP files, directly enabling T1190: Exploit Public-Facing Application.