CVE-2026-27996: WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerability

Q: Which deployments should be treated as affected?

Lingvico installations running version 1.0.14 or earlier should be treated as affected. The earliest affected version is not specified.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is required, although exploitation has high attack complexity and is network-accessible.

Q: What could a successful attack affect?

The CVSS assessment rates confidentiality, integrity, and availability impact as high. This indicates a successful exploit could have severe effects across all three security properties.

Published Mar 5, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Lingvico lingvico allows PHP Local File Inclusion.This issue affects Lingvico: from n/a through <= 1.0.14.

Affected Software

2 affected components

ThemeREX Lingvico<=1.0.14

WordPress Lingvico theme<=1.0.14

Event History

Mar 5, 2026

CVE Published

via MITRE·05:54 AM

Data Sourced

via MITRE·05:54 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be treated as affected?

Lingvico installations running version 1.0.14 or earlier should be treated as affected. The earliest affected version is not specified.

Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is required, although exploitation has high attack complexity and is network-accessible.

What could a successful attack affect?

The CVSS assessment rates confidentiality, integrity, and availability impact as high. This indicates a successful exploit could have severe effects across all three security properties.

CVE-2026-27996: WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments should be treated as affected?

Does exploitation require an authenticated WordPress account or user interaction?

What could a successful attack affect?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be treated as affected?

Does exploitation require an authenticated WordPress account or user interaction?

What could a successful attack affect?