CVE-2026-27065: BuilderPress LFI Vulnerability

CVE-2026-27065 Overview

CVE-2026-27065 is a critical Local File Inclusion (LFI) vulnerability affecting the ThimPress BuilderPress WordPress plugin. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files on the server. This flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

The vulnerability enables unauthenticated attackers to exploit the file inclusion mechanism to read sensitive files, execute arbitrary PHP code present on the server, or potentially escalate the attack to remote code execution under certain server configurations.

Critical Impact
Unauthenticated attackers can leverage this LFI vulnerability to read sensitive configuration files, access credentials, and potentially achieve remote code execution on vulnerable WordPress installations running BuilderPress versions up to 2.0.1.

Affected Products

ThimPress BuilderPress plugin versions from n/a through 2.0.1
WordPress installations using vulnerable BuilderPress plugin versions

Discovery Timeline

2026-03-19 - CVE-2026-27065 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-27065

Vulnerability Analysis

The BuilderPress plugin by ThimPress contains a PHP Local File Inclusion vulnerability that allows attackers to manipulate filename parameters passed to PHP's include() or require() functions. This vulnerability type is particularly dangerous in WordPress environments where plugins often handle user-supplied input to dynamically load templates or components.

The vulnerability can be exploited without authentication, meaning any remote attacker with network access to the WordPress installation can attempt exploitation. Successful exploitation grants the attacker access to sensitive server files and potentially enables code execution if the attacker can combine the LFI with other techniques such as log poisoning or session file inclusion.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-controlled parameters before they are used in file inclusion statements. The BuilderPress plugin fails to properly validate or restrict the file paths that can be included, allowing directory traversal sequences (such as ../) to escape the intended directory and access arbitrary files on the filesystem.

PHP applications are particularly susceptible to this class of vulnerability when they dynamically construct file paths based on user input without implementing proper allowlist validation or path canonicalization.

Attack Vector

The attack vector for CVE-2026-27065 is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests containing specially formatted path traversal sequences to read arbitrary files from the server's filesystem.

Common exploitation techniques for LFI vulnerabilities include:

Reading sensitive configuration files such as wp-config.php to obtain database credentials
Accessing system files like /etc/passwd for user enumeration
Combining LFI with log poisoning to achieve remote code execution by injecting PHP code into log files and subsequently including them
Exploiting PHP wrappers (such as php://filter) to read source code or bypass restrictions

For detailed technical analysis and exploitation examples, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27065

Indicators of Compromise

Suspicious HTTP requests containing path traversal sequences (../, ..%2f, ..%5c) targeting BuilderPress plugin endpoints
Requests attempting to access system files such as /etc/passwd, /etc/shadow, or WordPress configuration files
Unusual PHP wrapper usage in request parameters (e.g., php://filter, php://input)
Access logs showing repeated requests to BuilderPress plugin files with manipulated parameters

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in HTTP requests
Monitor access logs for requests containing encoded directory traversal patterns targeting the /wp-content/plugins/builderpress/ directory
Deploy endpoint detection solutions capable of identifying suspicious file access patterns from web server processes
Configure intrusion detection systems to alert on attempts to read sensitive system or WordPress configuration files

Monitoring Recommendations

Enable verbose logging for WordPress and the web server to capture detailed request information
Set up alerts for any access attempts to sensitive files from PHP processes, particularly wp-config.php and system configuration files
Monitor for unusual process spawning from web server processes that could indicate successful code execution
Implement file integrity monitoring on critical WordPress core and configuration files

How to Mitigate CVE-2026-27065

Immediate Actions Required

Update the BuilderPress plugin to the latest patched version immediately
If an update is not available, disable and remove the BuilderPress plugin from WordPress installations until a patch is released
Audit access logs to identify any previous exploitation attempts
Review WordPress file permissions to ensure minimal necessary access

Patch Information

The vulnerability affects BuilderPress versions from n/a through 2.0.1. Site administrators should check for available updates through the WordPress plugin repository or contact ThimPress directly for patch availability. For vulnerability details, see the Patchstack Vulnerability Report.

Workarounds

Disable the BuilderPress plugin if an immediate patch is not available
Implement Web Application Firewall (WAF) rules to block path traversal attempts
Restrict file system permissions to limit the impact of potential file inclusion attacks
Configure PHP open_basedir restrictions to limit file access to the WordPress installation directory

bash

# Example Apache .htaccess rules to block common LFI patterns
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{QUERY_STRING} (php://|data://|expect://|zip://) [NC]
    RewriteRule .* - [F,L]
</IfModule>