CVE-2026-27987
Received Received - Intake
Local File Inclusion Vulnerability in The Qlean ThemeREX

Publication date: 2026-03-05

Last updated on: 2026-03-06

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through <= 2.12.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-05
Last Modified
2026-03-06
Generated
2026-06-16
AI Q&A
2026-03-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27987
EUVD
EUVD-2026-9657
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
themerex the_qlean to 2.12 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-27987 is a Local File Inclusion (LFI) vulnerability in the WordPress Qlean Theme versions up to and including 2.12. It allows an unauthenticated attacker to include and display local files from the target website by exploiting improper control of filename for include/require statements in PHP. This can lead to exposure of sensitive information such as database credentials.

Impact Analysis

[{'type': 'paragraph', 'content': "Exploitation of this vulnerability can lead to exposure of sensitive information from the website, including database credentials. Depending on the website's configuration, an attacker could potentially take over the entire database. This represents a high severity risk to the confidentiality and integrity of the affected system."}] [1]

Compliance Impact

I don't know

Detection Guidance

This vulnerability allows an unauthenticated attacker to include and display local files from the target website, which can be detected by monitoring for suspicious HTTP requests attempting to include local files via the ThemeREX The Qlean theme.

While no specific detection commands are provided, users can look for unusual URL parameters or requests targeting the include/require functionality in the theme, which may indicate exploitation attempts.

Additionally, applying Patchstack’s mitigation rule can help block attacks targeting this vulnerability and can be used as a detection mechanism by logging blocked attempts.

Mitigation Strategies

Since no official patch is currently available for the theme, the immediate recommended step is to apply Patchstack’s mitigation rule to block attacks targeting this vulnerability.

Applying this mitigation will protect your website from exploitation until an official patch can be safely applied.

Users should also monitor their systems for any suspicious activity related to local file inclusion attempts and consider restricting access to sensitive files on the server.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart