The vulnerability CVE-2026-27048 in Elated-Themes The Aisle Core plugin arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary file disclosure or code execution depending on the server configuration. The affected versions are all up to and including 2.0.5. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the serious impact potential. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Elated-Themes communications for updates. Until a fix is available, restricting access to vulnerable endpoints and applying web application firewall rules to detect suspicious include/require requests may help mitigate risk.