The vulnerability CVE-2026-27990 affects ThemeREX ConFix up to version 1.013 and is characterized by improper control of the filename used in PHP include or require statements. This improper control leads to a PHP Local File Inclusion vulnerability, which can be exploited remotely over the network without privileges or user interaction. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code on the affected system. The impact affects confidentiality, integrity, and availability of the system running ThemeREX ConFix. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and monitor for unusual activity related to file inclusion attempts. Avoid exposing the affected application to untrusted networks if possible.