The vulnerability CVE-2026-27996 in ThemeREX Lingvico theme arises from improper validation of filenames in PHP include or require statements, enabling PHP Local File Inclusion. This allows an attacker to include local files on the server, which can lead to remote code execution or disclosure of sensitive information. The issue affects Lingvico versions up to 1.0.14. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity. No patch or vendor advisory details are provided in the input data.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is considered high. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme version and avoid exposing vulnerable installations to untrusted networks. Monitor official ThemeREX communications for updates and apply patches as soon as they are released.