The vulnerability CVE-2026-27997 in ThemeREX Maxify involves improper control of filenames in PHP include or require statements, enabling PHP Local File Inclusion. This flaw exists in Maxify versions up to 1.0.16 and can be exploited remotely over the network without authentication, but requires high attack complexity. The CVSS score is 8.1, indicating a high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or vendor advisory information is currently available.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the affected server, potentially leading to full system compromise including disclosure of sensitive information, modification of data, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality if possible and monitor for updates from ThemeREX.