PT-2026-27980 · Unknown · Mikado-Themes Rosebud

Published 2026-03-25 · Updated 2026-03-29 · CVE-2026-27081

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mikado-Themes Rosebud versions through 1.4

Description A flaw exists in the handling of filenames used in include/require statements within the PHP code of Mikado-Themes Rosebud, leading to a PHP Local File Inclusion issue. This allows for the inclusion of local files, potentially enabling unauthorized access or code execution.

Recommendations Versions prior to and including 1.4 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-27081

Affected Products

Mikado-Themes Rosebud

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27081 · Security Note
• https://twitter.com/CVEnew/status/2038250199953383678 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/rosebud/vulnerability/wordpress-rosebud-theme-1-4-local-file-inclusion-vulnerability?_s_id=cve · Note