The vulnerability CVE-2026-27995 in ThemeREX Justitia arises from improper validation of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited remotely over the network without privileges or user interaction. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability. The affected versions include all releases up to 1.1.0. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability allows an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and full system compromise. The CVSS score of 8.1 reflects high impact across confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable installations and applying general PHP security best practices to limit exposure. Monitor official ThemeREX communications for updates on patches or mitigations.