The vulnerability CVE-2026-27076 affects Mikado-Themes LuxeDrive (up to version 1.0) and involves improper control of filenames used in PHP include or require statements. This flaw permits PHP Local File Inclusion, which can allow an attacker to include and execute arbitrary local files on the server. The CVSS 3.1 base score is 8.1, reflecting a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service due to local file inclusion. The high CVSS score indicates significant risk if exploited. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Mikado-Themes communications for updates. Until a fix is available, restricting access to the vulnerable application and applying general PHP security best practices may reduce risk.