The vulnerability CVE-2026-27052 in the villatheme Sales Countdown Timer for WooCommerce and WordPress arises from improper control over the filename parameter used in PHP include or require statements. This flaw allows PHP Local File Inclusion, potentially enabling an attacker to include unintended files on the server. The affected versions are all versions before 1.1.9. The CVSS score is 7.5, indicating a high severity with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, which may lead to disclosure of sensitive information, modification of data, or disruption of service. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling or removing the affected plugin to mitigate risk.