The vulnerability CVE-2026-27994 in ThemeREX Tediss arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This flaw affects Tediss versions up to 1.2.4. Exploitation could allow an attacker to include arbitrary local files, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive local files, unauthorized code execution, and disruption of service on affected systems running ThemeREX Tediss up to version 1.2.4. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to vulnerable include/require functionality if possible, and monitor for updates from ThemeREX regarding patches or mitigations.