The vulnerability CVE-2026-27985 in ThemeREX Humanum arises from improper validation of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), where local files on the server can be included and executed by the PHP interpreter. The issue affects versions up to 1.1.4 of the Humanum theme. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected web server hosting the Humanum theme. The attacker can gain unauthorized access to system files and potentially escalate privileges or disrupt service. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints. Monitor for updates from ThemeREX regarding patches or official mitigations.