CVE-2026-27995: Justitia Theme File Inclusion Vulnerability

CVE-2026-27995 Overview

CVE-2026-27995 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability affecting the ThemeREX Justitia WordPress theme. This Local File Inclusion (LFI) vulnerability allows attackers to manipulate file inclusion parameters to access sensitive files on the server or potentially execute arbitrary PHP code through path manipulation techniques.

Critical Impact

This Local File Inclusion vulnerability in the Justitia WordPress theme could allow attackers to read sensitive configuration files, access credentials, or chain with other vulnerabilities for remote code execution on affected WordPress installations.

Affected Products

• ThemeREX Justitia WordPress Theme version 1.1.0 and earlier
• WordPress installations using vulnerable Justitia theme versions

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-27995 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27995

Vulnerability Analysis

This vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Justitia WordPress theme fails to properly validate and sanitize user-controlled input before using it in PHP file inclusion functions such as include(), include_once(), require(), or require_once().

When an attacker can influence the filename parameter passed to these functions, they can traverse the directory structure using sequences like ../ to access files outside the intended directory. This can lead to disclosure of sensitive information such as wp-config.php containing database credentials, or potentially achieve code execution if combined with file upload functionality or log poisoning techniques.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of user-supplied data that is subsequently used in PHP file inclusion statements. The Justitia theme does not implement proper allowlist validation or path canonicalization before including files dynamically. This allows attackers to inject directory traversal sequences or manipulate the include path to reference arbitrary files on the filesystem.

Attack Vector

The attack vector for this LFI vulnerability involves manipulating request parameters that control which PHP files are included by the theme. An attacker would craft a malicious request containing path traversal sequences such as ../../wp-config.php or use null byte injection (in older PHP versions) to bypass file extension restrictions.

Successful exploitation requires no authentication and can be performed remotely through HTTP requests to the affected WordPress site. The attacker needs to identify the vulnerable parameter and construct a payload that navigates to the target file while bypassing any rudimentary filtering that may be in place.

For technical details and proof-of-concept information, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2026-27995

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, ..%5c) targeting theme files
• Access log entries showing requests to theme directories with unusual parameters
• Unexpected file access patterns in web server logs, particularly to sensitive files like wp-config.php
• PHP error logs showing failed file inclusion attempts or warnings about accessed files

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in request parameters
• Monitor access logs for requests containing ../ sequences or encoded variants targeting the Justitia theme
• Enable PHP error logging and monitor for include() or require() related warnings
• Deploy intrusion detection systems with signatures for LFI attack patterns

Monitoring Recommendations

• Configure real-time alerting for any access attempts to wp-config.php or other sensitive WordPress files
• Monitor for unusual file read operations by the web server process outside normal web directories
• Implement file integrity monitoring on critical WordPress configuration files
• Review web server access logs regularly for anomalous request patterns targeting theme endpoints

How to Mitigate CVE-2026-27995

Immediate Actions Required

• Update the Justitia WordPress theme to a patched version when available from ThemeREX
• Implement a Web Application Firewall (WAF) with LFI protection rules
• Review server access logs for any signs of exploitation attempts
• Consider temporarily disabling or replacing the vulnerable theme if no patch is available

Patch Information

Check the Patchstack vulnerability database for the latest patch status and updated theme versions from ThemeREX. Contact the theme vendor directly for information on patched releases.

Workarounds

• Implement strict WAF rules to block path traversal sequences in all request parameters
• Use PHP's open_basedir directive to restrict file access to the WordPress installation directory
• Disable remote file inclusion by setting allow_url_include = Off in php.ini
• Apply principle of least privilege to web server file permissions

# PHP configuration hardening (php.ini)
# Disable remote file inclusion
allow_url_include = Off
allow_url_fopen = Off

# Restrict file access to web directory
open_basedir = /var/www/html/

# Apache mod_rewrite rule to block path traversal
# Add to .htaccess
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC]
RewriteRule .* - [F,L]