The vulnerability CVE-2026-27341 affects Mikado-Themes TopScorer - Sports WordPress Theme versions up to 1.2. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker to include unintended files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, no user interaction, and unchanged scope.

Successful exploitation of this vulnerability can lead to the inclusion and execution of arbitrary local files on the affected server, which may result in full compromise of the web server, disclosure of sensitive data, or disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the affected theme should monitor Mikado-Themes communications for updates. Until a fix is available, consider disabling or removing the vulnerable theme to mitigate risk.