The vulnerability CVE-2026-27997 in ThemeREX Maxify arises from insufficient validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary code or access sensitive files by including local files on the server. The issue affects Maxify versions up to 1.0.16. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service on the affected system. Given the high CVSS score and the nature of local file inclusion, attackers could potentially execute arbitrary code or gain further access to the server environment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to vulnerable endpoints as a temporary mitigation. Monitor official ThemeREX channels for updates and apply patches promptly once available.