CVE-2026-27097

HIGH

CasaMia Theme <=1.1.2 - PHP Local File Inclusion

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-27097. PoCs published by XiaomingX, hacker1337itme.

AI-analyzed exploit summary This repository contains a functional Python-based PoC for CVE-2026-27097, an LFI vulnerability in AncoraThemes CasaMia WordPress Theme. The exploit includes methods for vulnerability detection and file reading via LFI techniques.

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CasaMia | Property Rental Real Estate WordPress Theme casamia allows PHP Local File Inclusion.This issue affects CasaMia | Property Rental Real Estate WordPress Theme: from n/a through <= 1.1.2.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-27097

This repository contains a functional Python-based PoC for CVE-2026-27097, an LFI vulnerability in AncoraThemes CasaMia WordPress Theme. The exploit includes methods for vulnerability detection and file reading via LFI techniques.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: AncoraThemes CasaMia WordPress Theme <= 1.1.2
No auth needed
Prerequisites: Target running vulnerable CasaMia theme · Access to vulnerable parameter endpoints
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WORKING POC
by hacker1337itme · poc
https://github.com/hacker1337itme/CVE-2026-27097

This repository contains a functional Python-based proof-of-concept exploit for CVE-2026-27097, targeting a Local File Inclusion (LFI) vulnerability in the AncoraThemes CasaMia WordPress Theme (version <= 1.1.2). The exploit includes methods for vulnerability detection and file reading via LFI techniques.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: AncoraThemes CasaMia WordPress Theme <= 1.1.2
No auth needed
Prerequisites: Target running vulnerable CasaMia WordPress Theme · Network access to the target
devstral-2 · analyzed Mar 13, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 8.1
EPSS 0.0051
EPSS Percentile 39.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-98
Status published
Products (1)
AncoraThemes/CasaMia | Property Rental Real Estate WordPress Theme < 1.1.2
Published Mar 05, 2026
Tracked Since Mar 05, 2026