The vulnerability CVE-2026-27048 affects Elated-Themes The Aisle Core plugin for WordPress, specifically versions up to 2.0.5. It arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. This can allow attackers to execute arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published but no patch or official fix has been documented yet.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server. This can lead to disclosure of sensitive information, code execution, and full system compromise. The high CVSS score (8.1) reflects the critical nature of the impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version. Applying web application firewall (WAF) rules to block suspicious include requests may provide temporary mitigation. Avoid exposing the affected application to untrusted networks if possible.