Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through <= 2.1.6.
Published: 2026-03-25
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion leading to possible code execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a PHP Local File Inclusion flaw caused by improper validation of file names in the include/require statements of the Mikado‑Themes Curly Core plugin. An attacker can craft a request that causes the plugin to read arbitrary files from the server, potentially leading to disclosure of sensitive configuration files or execution of attacker‑supplied PHP code. This weakness is classified as a CWE‑98 vulnerability.

Affected Systems

The flaw is present in all releases of the Curly Core plugin up to and including version 2.1.6, which is distributed for WordPress sites. Any WordPress installation that has the plugin installed and is running a vulnerable version is at risk. The affected product is named Mikado‑Themes Curly Core on the Vendor side, and it is deployed as a WordPress plugin.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity, while the EPSS score is below 1 %, suggesting that active exploitation is currently unlikely. The vulnerability is not listed in CISA's KEV catalog, but it can be exploited from a remote attacker who can trigger the vulnerable request via a web browser or automated script. If an attacker succeeds, they can read arbitrary files or execute code, leading to full compromise of the affected WordPress site.

Generated by OpenCVE AI on March 26, 2026 at 17:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Curly Core plugin to a version newer than 2.1.6, or replace it with a safe alternative.
  • If an upgrade is not feasible immediately, disable or delete the plugin until a patch is applied.
  • Validate that all WordPress core files and plugins have correct file permissions to limit unauthorized file access.
  • Regularly monitor web server logs for unusual access to files within the WordPress installation.

Generated by OpenCVE AI on March 26, 2026 at 17:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mikado-themes
Mikado-themes curly
Wordpress
Wordpress wordpress
Vendors & Products Mikado-themes
Mikado-themes curly
Wordpress
Wordpress wordpress

Wed, 25 Mar 2026 16:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through <= 2.1.6.
Title WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Mikado-themes Curly
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-23T14:14:10.352Z

Reserved: 2026-02-17T13:23:18.876Z

Link: CVE-2026-27047

cve-icon Vulnrichment

Updated: 2026-03-26T15:13:56.617Z

cve-icon NVD

Status : Deferred

Published: 2026-03-25T17:16:53.990

Modified: 2026-04-24T16:35:20.070

Link: CVE-2026-27047

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:31:31Z

Weaknesses