CVE-2026-27065: ThimPress BuilderPress WordPress Plugin - Local File Inclusion

Overview

CVE-2026-27065 is recorded as a Local File Inclusion vulnerability in the BuilderPress plugin for WordPress, published by ThimPress. The record describes improper control of a filename used in a PHP include or require statement. The CNA is Patchstack, and the record states the issue affects BuilderPress up to and including 2.0.1.

Impact

• Confirmed: the record provides a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network reachability, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
• Confirmed: the SSVC data in the record marks the issue as automatable and with total technical impact.
• Inference: a file inclusion flaw of this kind can allow a remote party to cause the web application to read or process files it should not access, which may expose sensitive data or enable further compromise of the hosting environment.

Affected products and versions

• Product: ThimPress BuilderPress (plugin for WordPress).
• Affected range: up to and including 2.0.1, as stated in the record.
• Fixed version: not provided in the record. The absence of a listed fix does not confirm that no fix exists; check the vendor and the Patchstack entry for current information.

Exploitation status

• The CISA KEV catalog entry is not listed for this CVE in the record, so this record does not confirm active exploitation in the wild.
• No confirmed exploitation appears in the sources consulted.
• The EPSS probability in the record is 0.00616 (percentile 0.4887), and the SSVC exploitation field is 'none'. These are estimates and do not confirm exploitation.

Remediation and mitigation

• Identify all WordPress sites running BuilderPress and record installed versions.
• Because the record gives no fixed version, consult the vendor and the Patchstack entry for an updated release or guidance, and prioritize sites running 2.0.1 or earlier.
• If no fix is available, consider temporarily disabling or removing the plugin where it is not essential, and restrict access to administrative and plugin areas.
• Keep WordPress core and other plugins up to date and review web application firewall rules provided by your hosting or security vendor.

Detection guidance

• Review web server and application logs for unusual requests to BuilderPress endpoints that include file path parameters or unexpected file names.
• Monitor for unexpected file reads, new files, or changes in plugin directories.
• Alert on requests that contain path traversal patterns or references to system files, at a high level, without relying on a single signature.

Limitations of the available information

• The record does not provide a fixed version, a vendor advisory, or a detailed technical description beyond the summary text.
• The CWE entry is CWE-98, named 'PHP Remote File Inclusion', while the description and title describe a local file inclusion. This discrepancy should be verified with the CNA or the Patchstack entry.
• The record's EPSS date (2026-10-23) is later than the publication date and should be treated with caution.
• The source status is recorded as Deferred.

Frequently asked questions

What is CVE-2026-27065?

It is a Local File Inclusion vulnerability in the BuilderPress WordPress plugin by ThimPress, recorded as affecting versions up to and including 2.0.1.

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list a fixed version. Check the vendor and the Patchstack entry for current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.