CVE-2026-27988: WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Equadio equadio allows PHP Local File Inclusion.This issue affects Equadio: from n/a through <= 1.1.3.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects the ThemeREX Equadio WordPress theme through version 1.1.3. The available data does not identify a fixed version or confirm whether any particular default configuration is required.
Can an unauthenticated remote attacker exploit this?
The CVSS vector indicates network exposure with no privileges or user interaction required. Exploitation is rated high complexity, so additional unspecified conditions are needed.
What impact could successful exploitation have?
The reported CVSS metrics indicate high impact to confidentiality, integrity, and availability. The vulnerability is classified as PHP local file inclusion.