CVE-2026-27052: WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VillaTheme Sales Countdown Timer for WooCommerce and WordPress allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a before 1.1.9.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27052?
CVE-2026-27052 is classified as a Local File Inclusion vulnerability with a high severity impact on affected systems.
How do I fix CVE-2026-27052?
To fix CVE-2026-27052, update the Sales Countdown Timer for WooCommerce and WordPress plugin to the latest version that resolves this vulnerability.
Which versions of the plugin are affected by CVE-2026-27052?
CVE-2026-27052 affects versions of the Sales Countdown Timer for WooCommerce and WordPress plugin up to and including 1.1.8.1.
What are the potential impacts of CVE-2026-27052?
The potential impacts of CVE-2026-27052 include unauthorized access to sensitive files on the server due to improper filename controls.
Where can I find more information about CVE-2026-27052?
More information about CVE-2026-27052 can be found in security bulletins and vulnerability databases that track WordPress plugin vulnerabilities.