CVE-2026-27412

20th percentile — higher than 20% of all known CVEs

The Pearl - Corporate Business plugin version 3.4.10 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker can remotely read arbitrary files on the server without requiring authentication.

The risk involves potential leakage of sensitive data such as configuration files, passwords, or source code, which could lead to further attack escalation.

Immediately update the Pearl - Corporate Business plugin to a version newer than 3.4.10 if available, or apply temporary mitigations blocking access to vulnerable files.