Description Summary:
An unauthenticated PHP Object Injection vulnerability exists in AncoraThemes Agora versions 1.9 and earlier, allowing for potential remote code execution.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the AncoraThemes Agora theme poses a severe risk of remote code execution and complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65578

Affected Software: AncoraThemes Agora

Affected Versions: n/a through 1.9

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, categorized as CWE-502. It allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to arbitrary code execution on the underlying server.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows unauthenticated attackers to gain full control over the web application. Successful exploitation could lead to total data loss, unauthorized access to sensitive customer information, and significant reputational damage due to site defacement or malware distribution.

Remediation Plan

Immediate Action: Review the vendor's security updates and apply the latest version of the Agora theme as soon as it becomes available.

Proactive Monitoring: Monitor server access logs for anomalous requests, particularly those containing serialized PHP data structures or unexpected POST parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block common PHP object injection patterns and malicious serialized payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the critical severity and the potential for full system compromise without authentication, organizations using the Agora theme must prioritize this update. Administrators should verify the integrity of their WordPress installation immediately and prepare to deploy the vendor-supplied patch the moment it is released to mitigate the risk of exploitation.

Description Summary:
The AncoraThemes Advice WordPress theme contains an unauthenticated PHP Object Injection flaw that could allow remote attackers to execute arbitrary code.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Advice theme enables unauthenticated attackers to execute arbitrary code, posing a severe risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-65577

Affected Software: AncoraThemes Advice

Affected Versions: n/a through 1.18.0

Vulnerability: The theme is affected by CWE-502, Deserialization of Untrusted Data, which allows an attacker to inject malicious objects into the application. Because this is an unauthenticated vulnerability, it is accessible to any remote actor with network reach to the target web server.

Business Impact

The CVSS score of 9.8 highlights the critical nature of this flaw, as it permits full system compromise without any requirement for authentication. Successful exploitation may lead to total loss of confidentiality, integrity, and availability, potentially exposing customer data and impacting business operations.

Remediation Plan

Immediate Action: Update the Advice theme to the most recent version provided by AncoraThemes. In the event that an update is unavailable, ensure the theme is deactivated and removed from the server.

Proactive Monitoring: Review application logs for evidence of deserialization attempts or unusual system calls.

Compensating Controls: Implement a WAF to inspect incoming HTTP requests and block payloads that attempt to exploit PHP object deserialization.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of authentication, making it a critical priority for remediation.

Analyst Recommendation

Given the critical severity of this vulnerability, administrators must act quickly to secure their systems. Ensure that the Advice theme is updated to the latest version to mitigate the risk of remote code execution and potential data compromise.

Description Summary:
The AncoraThemes Adrena WordPress theme is susceptible to unauthenticated PHP Object Injection, enabling remote attackers to execute arbitrary code by manipulating serialized data.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Adrena theme allows unauthenticated remote attackers to execute arbitrary code and compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-65576

Affected Software: AncoraThemes Adrena

Affected Versions: n/a through 1.2.14

Vulnerability: This vulnerability involves CWE-502, Deserialization of Untrusted Data, where the application fails to validate serialized objects before processing them. As the vulnerability is unauthenticated, attackers can trigger the flaw remotely without needing legitimate user credentials.

Business Impact

A CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for complete system takeover. Organizations face significant risks including the theft of sensitive database information, injection of malicious scripts into the site, and potential lateral movement within the network infrastructure.

Remediation Plan

Immediate Action: Update the Adrena theme to the latest version immediately to address the deserialization flaw. If no patch is available, disable the theme to eliminate the attack vector.

Proactive Monitoring: Monitor server logs for anomalous activity and unexpected PHP execution patterns.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic and block malformed serialized objects that target this vulnerability.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Although exploitation has not been confirmed, the nature of the flaw makes it a prime candidate for automated exploitation campaigns.

Analyst Recommendation

This vulnerability represents a critical security gap that requires immediate attention. Security teams should audit their WordPress installations to confirm if the Adrena theme is in use and apply the necessary updates to secure the application environment.

Description Summary:
The AncoraThemes Accalia WordPress theme is vulnerable to unauthenticated PHP Object Injection, allowing remote code execution via deserialization of untrusted user input.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Accalia theme permits unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65575

Affected Software: AncoraThemes Accalia

Affected Versions: n/a through 1.5.3

Vulnerability: The flaw is categorized as CWE-502, Deserialization of Untrusted Data, which occurs when an application deserializes untrusted data without sufficient verification. Because this vulnerability is reachable by unauthenticated attackers, it presents a severe risk to the integrity and availability of the host environment.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary PHP code, leading to full server compromise, data exfiltration, or complete site defacement. With a CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or prior authentication, effectively providing a direct path for malicious actors to seize control of the underlying web server.

Remediation Plan

Immediate Action: Identify and update the Accalia theme to the latest available version provided by the vendor. If an update is not currently available, consider switching to a secure alternative or disabling the theme entirely until a patch is released.

Proactive Monitoring: Inspect web server access logs for suspicious serialized strings or unusual POST requests directed at theme-specific endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection patterns and prevent common deserialization payloads from reaching the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an exceptionally high-risk target for automated scanning and exploitation tools.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for trivial remote code execution. Administrators must prioritize the identification of all instances of the Accalia theme within their environment and apply the latest vendor updates immediately to prevent unauthorized access.

Description Summary:
The AncoraThemes Abogado WordPress theme contains an unauthenticated PHP object injection vulnerability, which could lead to remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection vulnerability in the AncoraThemes Abogado theme exposes the system to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65574

Affected Software: AncoraThemes Abogado

Affected Versions: <= 1.18

Vulnerability: This vulnerability involves the improper deserialization of untrusted data (CWE-502). Because the vulnerability is accessible to unauthenticated attackers, it provides a direct path for executing arbitrary PHP code on the server.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system. Exploitation would likely result in total system compromise, potentially leading to widespread data breaches and loss of service control.

Remediation Plan

Immediate Action: Update the Abogado theme to the latest version provided by AncoraThemes. If a patched version is not yet available, temporarily disable the theme to mitigate the risk of exploitation.

Proactive Monitoring: Regularly review server and application logs for suspicious serialized strings. Monitor for unexpected modifications to system files or configuration settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block malicious deserialization attempts directed at the WordPress theme.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the absence of authentication requirements and the high level of technical impact.

Analyst Recommendation

The severity of this issue necessitates an immediate response, including the application of security patches as soon as they are made available. Organizations should perform an immediate assessment of their WordPress environments to ensure this theme is updated or properly secured.

Description Summary:
The AncoraThemes Midi WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include statements. This flaw allows unauthorized access to sensitive files.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Midi theme allows unauthenticated attackers to read sensitive system files, posing a significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-28125

Affected Software: AncoraThemes Midi

Affected Versions: 0 through 1.14

Vulnerability: The vulnerability is a local file inclusion (CWE-98) occurring within the theme code. It allows an unauthenticated attacker to manipulate file paths in include statements to access arbitrary files on the underlying server.

Business Impact

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, database credentials, or application source code. Given the CVSS score of 8.1, this is a high-severity issue that could result in total compromise of the application environment, leading to potential data breaches and unauthorized administrative access.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately deactivate the Midi theme if it is not business critical or contact the vendor for an urgent update.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward theme-related PHP files.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block directory traversal attempts and malicious URL parameters that target file inclusion functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the lack of authentication required to trigger the flaw makes it an attractive target for automated scanning.

Analyst Recommendation

The severity of this local file inclusion vulnerability necessitates immediate attention to prevent unauthorized system access. Security teams should treat the Midi theme as high risk and implement strict access controls or switch to an alternative theme until a verified vendor patch is deployed.

Description Summary:
The AncoraThemes Notarius theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Notarius WordPress theme poses a high risk of unauthorized file access and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-28124

Affected Software: AncoraThemes Notarius

Affected Versions: 0 through 1.9

Vulnerability: This vulnerability, classified as CWE-98, involves an improper control of filenames for include or require statements within the PHP codebase. An unauthenticated attacker can leverage this flaw to perform Local File Inclusion, potentially accessing sensitive files on the server.

Business Impact

The ability for an unauthenticated user to perform Local File Inclusion represents a severe security risk, as it may lead to the exposure of sensitive configuration files, database credentials, or other proprietary system data. Given the CVSS score of 8.1, this vulnerability carries significant weight and could result in full system compromise or unauthorized data exfiltration if exploited successfully.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should verify if a newer version is available from the vendor or immediately deactivate the Notarius theme if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests, particularly those containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious PHP include requests targeting the theme directory.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is theoretically dangerous due to the lack of required authentication, the high complexity factor noted in the CVSS vector suggests successful exploitation is not trivial.

Analyst Recommendation

Given the potential for unauthorized file access, organizations utilizing the AncoraThemes Notarius theme must prioritize the assessment of their exposure. Until a verified patch is provided by the vendor, the safest course of action is to disable the theme to prevent potential exploitation of the file inclusion mechanism.

Description Summary:
The AncoraThemes Veil theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access or execution.

Executive Summary:
A local file inclusion vulnerability in the AncoraThemes Veil theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2026-28123

Affected Software: AncoraThemes Veil

Affected Versions: 0 through 1.9

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) that occurs when the application fails to properly sanitize user-supplied input used in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this flaw can lead to the exposure of sensitive configuration files, source code, or other internal system data. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and significant reputational damage if attackers leverage the flaw to execute arbitrary code.

Remediation Plan

Immediate Action: There is currently no official patch available; administrators should immediately disable or uninstall the Veil theme until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../../) or attempts to include non-PHP files through URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and sanitize requests targeting the theme's directory.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While a patch is currently missing, the high complexity (AC:H) of the exploit vector provides a temporary buffer for organizations to implement compensating controls.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Organizations utilizing the AncoraThemes Veil theme must prioritize the removal or deactivation of the component immediately, as no vendor-supplied fix is currently available. Continued monitoring of logs for abnormal activity is essential until a secure version is verified and deployed.

Description Summary:
The Anderson WordPress theme by AncoraThemes is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Anderson WordPress theme poses a significant risk of unauthorized file access and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-28121

Affected Software: AncoraThemes Anderson

Affected Versions: 0 through 1.4.2

Vulnerability: This vulnerability involves improper control of filenames used in PHP include or require statements, which allows an unauthenticated attacker to perform local file inclusion. By manipulating input parameters, an attacker can force the application to include arbitrary local files on the server.

Business Impact

The ability to include local files can lead to the exposure of sensitive configuration files, credentials, or source code, and may facilitate remote code execution if an attacker can influence the content of the included file. Given the CVSS score of 8.1, this flaw is categorized as high severity and represents a critical threat to the confidentiality and integrity of the hosting environment.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Anderson theme if it is not business critical.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal sequences or attempts to access system configuration files via PHP parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability depends on the ability of an attacker to reach the vulnerable PHP code path via the web interface.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion vulnerabilities, organizations should treat this as a priority. Administrators are urged to restrict access to the affected site or remove the theme until the vendor releases a security update that addresses the underlying file inclusion mechanism.

Description Summary:
A deserialization of untrusted data vulnerability in the AncoraThemes Melody theme allows for potential PHP object injection.

Executive Summary:
A critical deserialization vulnerability in the AncoraThemes Melody theme exposes systems to unauthorized object injection, which may result in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-22510

Affected Software: AncoraThemes Melody

Affected Versions: 0 through 1.6.3

Vulnerability: This vulnerability is categorized as CWE-502: Deserialization of Untrusted Data, which occurs when the application processes user-supplied data without sufficient validation. The vulnerability is exploitable by an unauthenticated attacker, potentially leading to arbitrary code execution or significant impact on system integrity.

Business Impact

Successful exploitation of this object injection flaw could allow an attacker to execute arbitrary code on the underlying server. Given the CVSS score of 8.1, the risk of total loss of confidentiality, integrity, and availability is high, which could lead to unauthorized data access and total system takeover.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for version updates or security patches provided by AncoraThemes. If a patch is not yet available, consider switching to a different theme or disabling the Melody theme entirely.

Proactive Monitoring: Monitor server access logs for suspicious serialized data patterns or unusual requests targeting the theme directory. Implement application-level logging to detect unexpected object instantiation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to filter or block malicious serialized objects in HTTP requests. Ensure that the web server process runs with the least privilege necessary to limit the blast radius of a potential code execution event.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is not currently confirmed to be weaponized, deserialization flaws are high-value targets for attackers and should be remediated with high priority.

Analyst Recommendation

Due to the severity of object injection vulnerabilities, administrators must treat this as a high-priority security event. We strongly recommend verifying the current installation version and applying the latest theme update immediately upon release by the vendor to prevent potential remote code execution.

Description Summary:
A local file inclusion vulnerability exists in the AncoraThemes Dentalux theme, allowing unauthenticated attackers to include arbitrary files on the server via improper filename control.

Executive Summary:
The AncoraThemes Dentalux theme contains a critical local file inclusion vulnerability that permits unauthenticated attackers to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2026-22508

Affected Software: AncoraThemes Dentalux

Affected Versions: 0 through 3.3

Vulnerability: The theme suffers from improper control of filenames used in include or require statements, categorized as CWE-98. This flaw allows an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data disclosure or system compromise.

Business Impact

Successful exploitation of this vulnerability can lead to full system compromise, as it allows attackers to read arbitrary files from the web server. Given the CVSS score of 8.1, this is a high-severity issue that poses a significant risk to data confidentiality and integrity. If the web server contains configuration files, credentials, or application source code, these assets could be exfiltrated and used to facilitate further attacks against the organization.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately audit their use of the Dentalux theme and consider switching to an alternative if a vendor update is not promptly released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests containing unusual file paths and PHP include parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and path traversal sequences.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows the inclusion of arbitrary files, which frequently serves as a precursor to remote code execution.

Analyst Recommendation

Due to the high severity of this file inclusion vulnerability, organizations running the affected version of the Dentalux theme must prioritize remediation. While a formal patch status is unknown, administrators should monitor the vendor's security advisory portal for updates and apply them immediately upon release. Until such time, implementing strict ingress filtering and WAF protections is essential to reduce the attack surface.

Description Summary:
AncoraThemes Morning Records is vulnerable to deserialization of untrusted data, which may allow an unauthenticated attacker to perform object injection.

Executive Summary:
A deserialization vulnerability in the AncoraThemes Morning Records theme allows unauthenticated object injection, posing a significant risk to site integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-22505

Affected Software: AncoraThemes Morning Records

Affected Versions: 0 through 1.2

Vulnerability: The theme suffers from a deserialization of untrusted data flaw (CWE-502), which allows an unauthenticated attacker to inject malicious objects into the application environment.

Business Impact

The exploitation of this vulnerability could lead to a complete compromise of the affected WordPress instance. With a CVSS score of 8.1, this high-severity flaw may result in unauthorized data access, arbitrary code execution, or significant service disruption, potentially causing reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should immediately disable or remove the Morning Records theme until a secure update is provided by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious serialized strings or unusual activity originating from unauthenticated requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common object injection payloads and unauthorized attempts to access theme-specific endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on deserialization makes this an inherently dangerous flaw, as successful exploitation often leads to remote code execution.

Analyst Recommendation

Given the high CVSS score and the nature of object injection vulnerabilities, the risk to the organization is substantial. Security teams must prioritize the immediate removal or deactivation of the vulnerable theme to prevent potential exploitation. We recommend maintaining a strict inventory of all installed themes and monitoring vendor security bulletins for the release of a patched version.

Description Summary:
AncoraThemes Mr. Cobbler allows unauthenticated attackers to perform Local File Inclusion via improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Mr. Cobbler theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22502

Affected Software: AncoraThemes Mr. Cobbler

Affected Versions: 0 through 1.1.9

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw occurring within the Mr. Cobbler theme. An unauthenticated attacker can manipulate file paths to include arbitrary files, leading to unauthorized information disclosure or remote code execution.

Business Impact

The ability for an unauthenticated user to include arbitrary files poses a severe threat to the confidentiality, integrity, and availability of the WordPress environment. Successful exploitation could allow an attacker to read configuration files containing database credentials or execute malicious PHP code, potentially resulting in a full site compromise. With a CVSS score of 8.1, the high severity reflects the significant risk of total system impact.

Remediation Plan

Immediate Action: Review the Patchstack advisory for the latest vendor guidance, as a specific patch version is currently not documented in the provided data. If no update is available, deactivate the Mr. Cobbler theme immediately.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal patterns, such as sequences of dots and slashes, directed at theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting the WordPress theme directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication, making it a priority for remediation.

Analyst Recommendation

Given the potential for complete system compromise, administrators should treat this vulnerability with extreme urgency. If a vendor-provided update is not available for the Mr. Cobbler theme, users should consider switching to an alternative, secure theme until the vulnerability is addressed by the developer to mitigate the risk of unauthorized access.

Description Summary:
The AncoraThemes Hypnotherapy WordPress theme contains a local file inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Hypnotherapy theme allows unauthenticated attackers to read arbitrary files from the server, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-22496

Affected Software: AncoraThemes Hypnotherapy

Affected Versions: 0 through 1.2.10

Vulnerability: This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to the exposure of sensitive configuration files or execution of malicious code.

Business Impact

The ability to perform local file inclusion allows an attacker to bypass authentication and access sensitive data stored on the web server. Given the CVSS score of 8.1, this vulnerability represents a high risk that could lead to full system compromise, unauthorized data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Since no specific patch is currently confirmed, users should immediately deactivate the Hypnotherapy theme if it is not business critical or switch to a secure alternative.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unexpected file inclusion requests targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently confirmed as exploited, the inherent risk of local file inclusion in a web application is high, necessitating proactive defensive measures.

Analyst Recommendation

Given the high CVSS severity and the nature of the flaw, administrators must prioritize the protection of their WordPress environments. If the Hypnotherapy theme cannot be updated to a secure version, it should be removed or disabled immediately to prevent potential exploitation. Consistent monitoring of server logs and the implementation of robust WAF rules are essential until a definitive vendor patch is verified and deployed.

Description Summary:
The Greenville theme for WordPress is vulnerable to local file inclusion due to improper control of filenames in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Greenville WordPress theme could allow an unauthenticated attacker to read arbitrary files or execute code on the server.

Vulnerability Details

CVE-ID: CVE-2026-22495

Affected Software: AncoraThemes Greenville

Affected Versions: 0 through 1.3.2

Vulnerability: This flaw is a Local File Inclusion (CWE-98) occurring within the theme's PHP include mechanisms. The vulnerability is exploitable by an unauthenticated attacker who can manipulate file paths to access sensitive system files or execute malicious scripts.

Business Impact

The potential for unauthorized file access and remote code execution poses a significant threat to data confidentiality and system integrity. Given the CVSS score of 8.1, successful exploitation could lead to full compromise of the WordPress environment, resulting in data breaches, installation of backdoors, or complete service disruption.

Remediation Plan

Immediate Action: Since no official patch version is currently identified, users should immediately deactivate and uninstall the Greenville theme if it is not business-critical. If the theme must remain in use, restrict access to the web server and monitor for suspicious file-inclusion patterns.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences or attempts to include unexpected PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a confirmed patch is concerning, the high complexity (AC:H) of the attack vector provides a slight buffer, though it does not eliminate the underlying risk.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for unauthorized code execution. Administrators should prioritize the removal of the vulnerable component or implement strict WAF protections while awaiting a formal vendor security update. Continued vigilance and regular auditing of theme components are essential to maintaining a secure WordPress environment.

Description Summary:
AncoraThemes UnlimHost is vulnerable to local file inclusion due to improper control of filenames in PHP include or require statements, allowing unauthorized file access.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes UnlimHost WordPress theme exposes the host system to unauthorized file access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-22380

Affected Software: AncoraThemes UnlimHost

Affected Versions: 0 through 1.2.3

Vulnerability: The theme fails to properly sanitize user-supplied input used in PHP include or require statements, which constitutes a local file inclusion vulnerability. This flaw can be triggered by an unauthenticated attacker via the network.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting its high potential for impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to read arbitrary files on the server, which may lead to the disclosure of sensitive configuration data or facilitate full system compromise through code execution.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately disable or remove the UnlimHost theme if it is not business-critical. If the theme must remain active, contact the vendor for an urgent security update.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or unexpected file path references in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in our curated sources.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the nature of local file inclusion flaws poses a significant risk to underlying server integrity.

Analyst Recommendation

Given the high severity of this vulnerability, immediate defensive action is required to protect the hosting environment. Organizations should prioritize removing or updating the vulnerable UnlimHost theme to prevent unauthorized access and potential escalation to remote code execution.

Description Summary:
The AncoraThemes Blabber theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements. This flaw allows unauthorized access to sensitive server files.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Blabber theme allows unauthenticated attackers to read arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22378

Affected Software: AncoraThemes Blabber

Affected Versions: 0 through 1.7.0

Vulnerability: This vulnerability is a local file inclusion (CWE-98) flaw occurring within the theme's PHP include logic, which can be triggered by an unauthenticated attacker to manipulate file paths and access unauthorized content.

Business Impact

The ability to perform local file inclusion poses a severe risk to data confidentiality and integrity, as it may allow an attacker to read configuration files, source code, or sensitive system data. Given the CVSS score of 8.1, this vulnerability is classified as High, reflecting the potential for full system compromise or information disclosure that could lead to significant reputational and operational damage.

Remediation Plan

Immediate Action: There is currently no confirmed patch available; immediately deactivate the Blabber theme until a security update is released by AncoraThemes.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common file inclusion patterns.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the provided data.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific conditions due to the high attack complexity noted in the CVSS vector, the nature of the flaw makes it a primary target for attackers seeking to extract sensitive credentials or environment variables.

Analyst Recommendation

Due to the severity of this file inclusion vulnerability, organizations should prioritize the immediate deactivation of the affected theme to eliminate the attack surface. Security teams must remain vigilant for vendor-provided updates and maintain robust logging to detect any potential unauthorized access attempts until a permanent fix is verified and applied.

Description Summary:
A Local File Inclusion vulnerability in the AncoraThemes Parkivia theme allows unauthenticated attackers to include arbitrary files, potentially leading to unauthorized data access or code execution.

Executive Summary:
The AncoraThemes Parkivia theme is vulnerable to Local File Inclusion, which poses a high risk of unauthorized file access and potential system compromise for affected WordPress installations.

Vulnerability Details

CVE-ID: CVE-2026-22376

Affected Software: AncoraThemes Parkivia

Affected Versions: 0 through 1.1.9

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw caused by improper control of filenames used in include or require statements within the PHP code. An unauthenticated attacker can exploit this via the network to read sensitive server files or execute arbitrary code.

Business Impact

Successful exploitation allows an attacker to read sensitive configuration files or execute malicious PHP scripts on the underlying server. Given the CVSS score of 8.1, this vulnerability presents a significant risk to data confidentiality and integrity, potentially leading to complete system compromise if the theme is used in a high-privilege environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the AncoraThemes website for security updates and apply them as soon as they become available. If no update is provided, consider switching to a different theme or disabling the affected functionality if possible.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unexpected file inclusion requests targeting the theme directory.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically exploitable by an unauthenticated remote attacker, the high attack complexity noted in the CVSS vector suggests that specific environmental conditions are required to achieve successful execution.

Analyst Recommendation

This vulnerability represents a critical security gap for WordPress sites utilizing the Parkivia theme. Security teams must prioritize patching as soon as the vendor releases a fix, while maintaining strict monitoring for any anomalous activity that might indicate an attempt to leverage this file inclusion flaw.

Description Summary:
AncoraThemes Zio Alberto is vulnerable to Local File Inclusion via improper control of filenames in include statements, potentially allowing unauthorized file access.

Executive Summary:
AncoraThemes Zio Alberto contains a Local File Inclusion vulnerability that could allow an unauthenticated attacker to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2026-22374

Affected Software: AncoraThemes Zio Alberto

Affected Versions: 0 through 1.2.2

Vulnerability: This vulnerability, classified as CWE-98, occurs due to improper control of filenames in include or require statements. An unauthenticated attacker can leverage this flaw to perform Local File Inclusion, potentially leading to unauthorized data exposure or system compromise.

Business Impact

The ability to include local files can lead to the exposure of configuration files, credentials, or sensitive source code, severely compromising the confidentiality and integrity of the web application. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full system compromise if an attacker is able to execute arbitrary code through the included files.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should audit the Zio Alberto theme for suspicious file inclusion patterns and restrict directory access permissions. Ensure the theme is updated to the latest available version if the vendor releases a fix.

Proactive Monitoring: Monitor web server access logs for requests containing directory traversal sequences, such as "../", or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant because it allows unauthenticated interaction with the server filesystem.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, this issue poses a substantial risk to the security of the hosting environment. Organizations should prioritize isolating the affected theme and implementing strict input validation or WAF protections until a verified security update is provided by AncoraThemes.

Description Summary:
The AncoraThemes Isida theme for WordPress is vulnerable to local file inclusion due to improper control of filenames in include or require statements.

Executive Summary:
The AncoraThemes Isida theme contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive files or achieve unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-22372

Affected Software: AncoraThemes Isida

Affected Versions: 0 through 1.4.2

Vulnerability: The flaw, categorized as CWE-98, arises from improper validation of user-supplied input used in PHP include or require statements. This vulnerability is exploitable by unauthenticated attackers, potentially allowing them to include arbitrary local files on the server.

Business Impact

A successful exploit of this vulnerability could lead to the unauthorized disclosure of sensitive server files, configuration data, or internal source code. Given the CVSS score of 8.1, the risk of total system compromise is high, which could result in significant data breaches and severe reputational damage.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately deactivate or uninstall the Isida theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or unexpected file path requests, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and sanitize directory traversal attempts in URL parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk of exploitation is currently theoretical, the nature of local file inclusion flaws often allows for rapid development of functional exploits once technical details are published.

Analyst Recommendation

Given the high CVSS severity and the potential for total impact, organizations currently utilizing the AncoraThemes Isida theme must treat this as a high-priority security risk. Administrators should remove the affected software immediately and monitor systems for any signs of unauthorized access, pending further guidance or a security update from the vendor.

Description Summary:
A deserialization of untrusted data vulnerability in the AncoraThemes BugsPatrol theme allows for remote object injection.

Executive Summary:
The AncoraThemes BugsPatrol theme is vulnerable to an object injection flaw that may allow unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-60225

Affected Software: AncoraThemes BugsPatrol

Affected Versions: 0 through 1.5.0

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, which can lead to PHP object injection. The flaw is exploitable by unauthenticated remote attackers with no required user interaction.

Business Impact

The CVSS score of 9.8 reflects the critical severity of this vulnerability, as it allows for full compromise of the application. An attacker leveraging this flaw could execute arbitrary code, potentially leading to total system takeover, unauthorized data access, and complete loss of confidentiality, integrity, and availability for the affected WordPress site.

Remediation Plan

Immediate Action: Check the official WordPress repository or the vendor portal for a security update that addresses this deserialization flaw. If a patch is not yet available, immediately deactivate the BugsPatrol theme until a secure version is released.

Proactive Monitoring: Review web server and PHP error logs for unusual serialized objects or suspicious input patterns. Monitor for unauthorized file modifications or unexpected outbound network connections from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP payloads. Ensure the WordPress environment is running with the principle of least privilege to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. Insecure deserialization flaws are inherently dangerous, often providing a direct path to remote code execution if the application environment contains reachable gadget chains.

Analyst Recommendation

Given the critical CVSS severity and the potential for unauthenticated remote code execution, this vulnerability poses a severe risk to organizational infrastructure. Administrators must prioritize the removal or patching of the affected theme immediately. If an official fix has not been published by the vendor, the theme should be considered unsafe for use in a production environment.

Description Summary:
The AncoraThemes Fabrica WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
The AncoraThemes Fabrica theme for WordPress contains a critical local file inclusion vulnerability that could allow unauthenticated attackers to access sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-60055

Affected Software: AncoraThemes Fabrica

Affected Versions: 0 through 1.8.1

Vulnerability: This flaw is classified as a local file inclusion (CWE-98) vulnerability. It allows an unauthenticated attacker to manipulate input parameters to include unauthorized files, potentially resulting in full system compromise.

Business Impact

A successful exploit of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. Given the CVSS score of 8.2, this is a high-severity issue that could lead to unauthorized data exfiltration, remote code execution, or complete site takeover by an unauthenticated remote actor.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately audit their use of the Fabrica theme and consider switching to a secure, supported alternative until a vendor update is confirmed.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common path traversal and local file inclusion attack vectors targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature makes it highly dangerous if exposed, as it does not require user interaction or authentication to execute.

Analyst Recommendation

Due to the high severity of this file inclusion vulnerability, immediate action is required to reduce the attack surface. If you are currently running AncoraThemes Fabrica version 1.8.1 or earlier, isolate the affected application from public networks or implement strict WAF filtering until the vendor releases a security update that explicitly addresses this flaw.

Description Summary:
The OnLeash theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
An unauthenticated local file inclusion vulnerability in the AncoraThemes OnLeash WordPress theme poses a high risk of unauthorized file access and remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-60054

Affected Software: AncoraThemes OnLeash

Affected Versions: 0 through 1.5.2

Vulnerability: This vulnerability, classified as CWE-98, occurs because the theme fails to properly sanitize user-supplied input before using it in a PHP include or require statement. An unauthenticated attacker can leverage this flaw to include arbitrary local files, potentially leading to information disclosure or remote code execution.

Business Impact

The exploitation of this vulnerability could lead to a total compromise of the affected WordPress instance. With a CVSS score of 8.2, this issue represents a high-severity threat that could result in sensitive data theft, unauthorized system modification, or complete service disruption.

Remediation Plan

Immediate Action: Since no specific patch version is documented, users should monitor the vendor's security advisory page and immediately update the OnLeash theme as soon as a fix is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and restrict access to sensitive application files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability is hindered by the requirement for specific environmental configurations.

Analyst Recommendation

Given the potential for complete system compromise, administrators must treat this vulnerability with high priority. We recommend disabling the OnLeash theme if it is not strictly necessary until an official vendor update is applied to remediate the underlying code flaw.

Description Summary:
The AncoraThemes MaxCube WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes MaxCube theme allows unauthenticated attackers to read sensitive files or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-60053

Affected Software: AncoraThemes MaxCube

Affected Versions: 0 through 1.3.1

Vulnerability: This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements. An unauthenticated attacker can supply malicious input to trigger local file inclusion, potentially leading to information disclosure or system compromise.

Business Impact

The ability to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the host server. Attackers may gain unauthorized access to sensitive configuration files, environment variables, or credentials, which could lead to a full system compromise. Given the CVSS score of 8.2, this vulnerability represents a significant threat to organizational security and infrastructure integrity.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate or uninstall the MaxCube theme if it is not essential for business operations.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting the WordPress environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on the specific configuration of the host server and the presence of accessible sensitive files.

Analyst Recommendation

Due to the lack of an available patch, this vulnerability must be treated with high urgency. Organizations utilizing the AncoraThemes MaxCube theme should prioritize removing the software from their production environments or restricting access to the affected components until a vendor-supplied update becomes available. Failure to address this flaw leaves the application susceptible to unauthorized file access and potential remote code execution.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes W&D theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes W&D theme creates a high risk of remote code execution and unauthorized file access.

Vulnerability Details

CVE-ID: CVE-2025-60052

Affected Software: AncoraThemes W&D

Affected Versions: 0 through 1.0

Vulnerability: The theme suffers from improper control of filenames for include statements, which allows an unauthenticated attacker to perform Local File Inclusion. This flaw enables the execution of arbitrary PHP code or the unauthorized retrieval of sensitive configuration files from the server.

Business Impact

The exploitation of this vulnerability can lead to a total compromise of the affected WordPress site, including the potential for remote code execution. With a CVSS score of 8.2, this is a High severity issue that could result in full data exfiltration, unauthorized modification of site content, and potential lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate and remove the W&D theme until a security update is released by AncoraThemes.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions, such as references to etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion patterns to mitigate risk until the theme can be updated or replaced.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the risk of exploitation is high due to the nature of the flaw, the lack of a known public exploit provides a brief window for remediation.

Analyst Recommendation

Given the high severity and the potential for complete site takeover, immediate action is required to secure the environment. Organizations currently utilizing the AncoraThemes W&D theme should prioritize its removal or replacement to eliminate the attack vector, as the lack of a vendor-provided patch leaves the system exposed to potential exploitation.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes Rare Radio WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the AncoraThemes Rare Radio theme permits unauthenticated attackers to access sensitive files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-60051

Affected Software: AncoraThemes Rare Radio

Affected Versions: 0 through 1.0.15.1

Vulnerability: This vulnerability is categorized as CWE-98, involving improper control of filenames used in PHP include or require statements. It allows an unauthenticated attacker to perform local file inclusion, potentially leading to the disclosure of sensitive server information or execution of arbitrary local scripts.

Business Impact

The ability to include local files can lead to a full compromise of the web application, including the theft of configuration files, database credentials, or sensitive user data. With a CVSS score of 8.2, this vulnerability represents a significant risk to confidentiality, integrity, and availability, as it allows attackers to bypass standard access controls without requiring prior authentication.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official AncoraThemes patch repository for an update that addresses this LFI flaw. If no update is available, consider switching to a different theme or disabling the Rare Radio theme until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited, the nature of LFI flaws makes them highly attractive to attackers for reconnaissance and privilege escalation.

Analyst Recommendation

Given the high CVSS severity and the potential for unauthorized access to sensitive system files, this vulnerability should be treated with urgency. We recommend immediate review of current theme versions and the implementation of WAF filtering to mitigate potential exploitation attempts while awaiting a formal vendor patch.

Description Summary:
An unauthenticated local file inclusion (LFI) vulnerability exists in AncoraThemes Lighthouse versions 1 and below, allowing for potential sensitive file disclosure.

Executive Summary:
AncoraThemes Lighthouse is susceptible to an unauthenticated local file inclusion vulnerability, enabling attackers to read sensitive files from the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-58902

Affected Software: AncoraThemes Lighthouse

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a Local File Inclusion (LFI) vulnerability that permits an unauthenticated attacker to manipulate file path parameters. This allows the attacker to access sensitive configuration files or system data stored on the web server.

Business Impact

Successful exploitation allows attackers to gain unauthorized access to configuration files, which may contain database credentials, API keys, or sensitive system information. Given the CVSS score of 8.1, the risk of full site compromise and subsequent data breaches is significant, necessitating rapid mitigation to prevent reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Lighthouse theme or plugin as soon as a security update is released by AncoraThemes.

Proactive Monitoring: Monitor web server logs for suspicious requests containing directory traversal sequences (e.g., ../) or attempts to access common system files like /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malformed URI requests targeting sensitive file paths.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

LFI vulnerabilities are a high-risk vector for server compromise and should be prioritized for remediation. Site administrators should monitor the vendor's release channels and apply the necessary updates immediately to secure their application against unauthorized file access.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes HealthHub theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes HealthHub theme (versions 1.3.0 and prior) poses a high risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2025-58898

Affected Software: AncoraThemes HealthHub

Affected Versions: 0 through 1.3.0

Vulnerability: The vulnerability exists due to improper control of filenames used in include or require statements, permitting Local File Inclusion. This flaw is accessible to unauthenticated attackers over the network.

Business Impact

Successful exploitation allows an attacker to read sensitive files on the server or potentially execute arbitrary code, depending on the server configuration. With a CVSS score of 8.2, this vulnerability represents a significant threat to data confidentiality, integrity, and availability, potentially leading to a full site takeover.

Remediation Plan

Immediate Action: Review the official Patchstack vendor advisory to determine if a patched version has been released for the HealthHub theme and apply it immediately. If no update is available, consider disabling the theme until a secure version is provided.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal sequences or attempts to access sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal patterns and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit exists in the provided data).

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the high severity of LFI vulnerabilities requires proactive patching to prevent potential unauthorized access.

Analyst Recommendation

Given the high impact of this Local File Inclusion vulnerability, administrators should prioritize checking for vendor updates. If the theme is currently in use, ensure that compensating security controls are active while awaiting a formal patch to protect the underlying server environment from unauthorized file access.

Description Summary:
The Otaku WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access or remote code execution.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Otaku theme poses a significant risk of unauthorized data access and system compromise.

Vulnerability Details

CVE-ID: CVE-2025-58896

Affected Software: AncoraThemes Otaku

Affected Versions: 0 through 1.8.0

Vulnerability: This vulnerability, classified as CWE-98, involves improper control of filenames used in PHP include or require statements. An unauthenticated attacker can exploit this flaw to perform local file inclusion, which may lead to the disclosure of sensitive files or the execution of arbitrary code on the underlying server.

Business Impact

Successful exploitation of this vulnerability can lead to complete system compromise, including the exposure of sensitive configuration files, database credentials, and internal application logic. Given the CVSS score of 8.2, this represents a high-severity risk that could result in significant data breaches and unauthorized control over the affected WordPress environment.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should immediately deactivate or uninstall the Otaku theme if it is not strictly necessary for site operations. If the theme must remain active, ensure that all file permissions are hardened and restrict access to the web root.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal sequences or attempts to include unexpected local files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized attempts to access sensitive PHP files.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on the specific configuration of the host server and the ability of an attacker to reach the vulnerable PHP code path.

Analyst Recommendation

The vulnerability in the AncoraThemes Otaku theme presents a substantial risk to the integrity and confidentiality of the host environment. Organizations should prioritize removing or restricting the use of this theme until the vendor releases an official security update that resolves the underlying file inclusion flaw.

Description Summary:
The AncoraThemes Integro theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the AncoraThemes Integro theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58895

Affected Software: AncoraThemes Integro

Affected Versions: 0 through 1.8.0

Vulnerability: This vulnerability, categorized as CWE-98, occurs when user-supplied input is insufficiently validated before being passed to a PHP include or require statement. An unauthenticated attacker can leverage this flaw to include local files, leading to unauthorized information disclosure or remote code execution.

Business Impact

The impact of this vulnerability is significant, as it grants attackers the ability to read sensitive server-side files or execute arbitrary PHP code. This could lead to a total compromise of the WordPress environment, resulting in full data exfiltration, unauthorized modification of site content, or complete system takeover. With a CVSS score of 8.2, this flaw represents a high risk that requires immediate attention to prevent operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Integro theme if it is not business-critical. If the theme must remain active, contact AncoraThemes support to inquire about a security patch or alternative mitigation.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, such as sequences involving "../". Monitor system integrity for unauthorized file modifications or the creation of unfamiliar PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion requests. Restrict server-level file permissions to ensure the web server user can only access necessary files.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently associated with known active campaigns, the nature of Local File Inclusion flaws makes them highly attractive targets for automated scanning and exploitation.

Analyst Recommendation

Given the severity of this vulnerability and the potential for full system compromise, organizations currently running the AncoraThemes Integro theme should prioritize risk mitigation immediately. While no public exploit is currently confirmed, unauthenticated access to system files presents an unacceptable risk profile. Deactivation is the recommended course of action until the vendor provides an official security update or a verified fix.

Description Summary:
A Local File Inclusion vulnerability exists in the AncoraThemes Tourimo theme, allowing unauthorized file access via improper handling of include statements.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Tourimo theme allows attackers to potentially read sensitive system files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-58892

Affected Software: AncoraThemes Tourimo

Affected Versions: 0 through 1.2.3

Vulnerability: This vulnerability (CWE-98) involves improper control of filenames during PHP include operations, which permits an unauthenticated attacker to perform Local File Inclusion. By manipulating input parameters, an attacker can force the application to process local files, leading to sensitive data exposure or potential remote code execution.

Business Impact

The vulnerability carries a CVSS score of 8.2, reflecting a high severity due to the potential for full system compromise. Successful exploitation could lead to the unauthorized disclosure of configuration files, credentials, or source code, and may allow an attacker to achieve code execution, resulting in complete system takeover and significant reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately audit their installation and disable the Tourimo theme until a security update is released by AncoraThemes.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal sequences or attempts to access system files such as wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns, such as directory traversal attempts or unexpected file path inclusions in URL parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct interaction with the server filesystem via the application layer, which is a common target for automated scanning tools.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion flaws, this vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Organizations utilizing the Tourimo theme must prioritize vigilance, restrict public access to the affected site where possible, and monitor official vendor channels for the release of a corrective update.

Description Summary:
The AncoraThemes Sanger WordPress theme contains a PHP Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
An unauthenticated PHP Local File Inclusion vulnerability in the AncoraThemes Sanger theme allows attackers to potentially execute arbitrary code or access sensitive files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58891

Affected Software: AncoraThemes Sanger

Affected Versions: 0 through 1.24.0

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw that permits an unauthenticated attacker to manipulate file paths during include or require operations, potentially leading to unauthorized data disclosure or remote code execution.

Business Impact

The vulnerability carries a CVSS score of 8.2, reflecting a high severity due to the potential for total system compromise. Successful exploitation could lead to the exposure of configuration files, database credentials, or the execution of malicious scripts, resulting in significant data breaches and total loss of confidentiality, integrity, and availability for the affected web application.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate or remove the Sanger theme until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack vectors and path traversal attempts targeting the web directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is not currently associated with known active exploitation, the nature of the flaw makes it a high-value target for automated scanning and manual exploitation attempts.

Analyst Recommendation

Given the high CVSS score and the critical nature of Local File Inclusion flaws, immediate action is required to secure the environment. Organizations currently using the Sanger theme must prioritize its removal or restriction until the vendor provides a verified patch, as this vulnerability provides a direct pathway for attackers to compromise the underlying server infrastructure.

Description Summary:
The AncoraThemes Playful theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A critical Local File Inclusion vulnerability in the AncoraThemes Playful theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58890

Affected Software: AncoraThemes Playful

Affected Versions: 0 through 1.19.0

Vulnerability: This vulnerability, categorized as CWE-98, occurs because the theme fails to properly sanitize input before using it in file inclusion functions. An unauthenticated attacker can leverage this flaw to include unauthorized files, leading to sensitive data exposure or complete system compromise.

Business Impact

The ability to perform Local File Inclusion (LFI) poses a severe risk to organizational data and infrastructure. By accessing configuration files or application source code, an attacker could extract database credentials or other sensitive information, potentially leading to full system takeover. With a CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should immediately switch to a different, secure theme or disable the Playful theme entirely until the vendor releases a security update.

Proactive Monitoring: Security teams should monitor server access logs for suspicious path traversal patterns, such as sequences containing ".." or references to sensitive files like "/etc/passwd" or "wp-config.php".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI attack vectors and directory traversal attempts to provide a virtual patch layer.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the provided data.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant due to the lack of required authentication, making it an attractive target for automated scanning tools.

Analyst Recommendation

Given the high CVSS score and the nature of LFI vulnerabilities, the risk of data exfiltration is substantial. Organizations currently using the Playful theme must prioritize its removal or deactivation until an official update is provided by AncoraThemes. Failure to mitigate this risk leaves the underlying WordPress instance highly vulnerable to remote compromise.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes The Flash WordPress theme allows unauthenticated attackers to include arbitrary files on the server.

Executive Summary:
The AncoraThemes The Flash theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary code or expose sensitive system files.

Vulnerability Details

CVE-ID: CVE-2025-58888

Affected Software: AncoraThemes The Flash

Affected Versions: 0 through 1.15

Vulnerability: This vulnerability is caused by improper control of filenames used in include or require statements. An unauthenticated attacker can leverage this flaw to perform Local File Inclusion, potentially leading to unauthorized access to sensitive application data or remote code execution.

Business Impact

The potential for Local File Inclusion presents a significant security risk, as it may allow unauthorized parties to read configuration files, access credentials, or execute malicious scripts on the web server. Given the CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent full system compromise.

Remediation Plan

Immediate Action: As no official patch is currently identified, users should immediately deactivate and remove the affected theme if it is not strictly necessary for site operations.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal patterns, such as sequences like dot-dot-slash (../), which are common in LFI attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious file inclusion attempts targeting PHP include parameters.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication for the affected PHP functions.

Analyst Recommendation

The vulnerability in The Flash theme poses a severe risk to the integrity and confidentiality of the host environment. Administrators must prioritize the removal of the vulnerable theme until a secure update is provided by the vendor. Ensure all WordPress installations are running minimal required plugins and themes to reduce the overall attack surface.

Description Summary:
The AncoraThemes Pathfinder WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
The AncoraThemes Pathfinder theme contains a critical local file inclusion vulnerability that allows unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-58885

Affected Software: AncoraThemes Pathfinder

Affected Versions: 0 through 1.16

Vulnerability: This vulnerability, categorized as CWE-98, arises from improper handling of user-supplied input in include or require statements within the PHP codebase. An unauthenticated attacker can exploit this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

The ability to perform local file inclusion poses a severe risk to the confidentiality and integrity of the entire web environment. With a CVSS score of 8.2, this vulnerability could allow attackers to bypass security restrictions, access sensitive configuration files or credentials, and potentially take full control of the affected web server, leading to significant data breaches or service disruption.

Remediation Plan

Immediate Action: Since no official patch is currently listed, administrators should immediately disable or remove the Pathfinder theme from their WordPress environment until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters or unexpected file path inclusions, which may help mitigate exploitation attempts until the software is updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the lack of a public exploit reduces immediate automated risk, the nature of local file inclusion makes this a high-priority target for attackers seeking to compromise host systems.

Analyst Recommendation

Given the high CVSS score and the critical nature of file inclusion vulnerabilities, organizations currently running the AncoraThemes Pathfinder theme must prioritize immediate mitigation. Because a patch is not yet confirmed, the safest course of action is to replace or deactivate the theme until the vendor provides a remediation update. Failure to address this flaw could lead to complete server compromise.

Description Summary:
The AncoraThemes Festy theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate file paths in include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Festy theme allows unauthenticated attackers to access sensitive files and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-58879

Affected Software: AncoraThemes Festy

Affected Versions: 0 through 1.13.0

Vulnerability: This vulnerability, classified as CWE-98, arises from improper control of filenames used in PHP include or require statements. An unauthenticated attacker can supply malicious input to the theme to perform local file inclusion, potentially leading to unauthorized information disclosure or code execution.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational data integrity and system availability. With a CVSS score of 8.2, this flaw facilitates unauthorized access to sensitive server-side files, which can be leveraged to compromise the entire WordPress installation or pivot into the underlying hosting environment.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or remove the Festy theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should monitor server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and sanitize input parameters associated with theme functionality.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of required authentication, making it a high-value target for automated scanning tools.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and the potential for full system compromise, immediate mitigation is required. Organizations currently utilizing the AncoraThemes Festy theme must prioritize its removal or restriction until an official security update is provided by the vendor. Organizations should verify their current theme version against the affected range and maintain a posture of least privilege for the web server service account.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes EasyEat WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes EasyEat theme poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-53433

Affected Software: AncoraThemes EasyEat

Affected Versions: 0 through 1.9.0

Vulnerability: The theme fails to properly validate input used in include or require statements, enabling an unauthenticated attacker to perform Local File Inclusion. This flaw allows attackers to read sensitive files or potentially execute arbitrary code on the underlying server.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity due to the lack of required authentication and the potential for total system compromise. Successful exploitation could lead to the exposure of sensitive configuration files, database credentials, or full remote code execution, resulting in significant data breaches and extended service downtime.

Remediation Plan

Immediate Action: As no specific patched version is currently listed, users should immediately deactivate and uninstall the EasyEat theme until a security update is released by AncoraThemes.

Proactive Monitoring: Review web server and PHP error logs for suspicious file inclusion patterns, such as strings containing directory traversal sequences or references to sensitive files like etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and requests targeting PHP include or require parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Dec 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows attackers to bypass standard application logic to access restricted files on the host server.

Analyst Recommendation

Given the critical CVSS severity and the nature of Local File Inclusion vulnerabilities, the risk to the environment is extreme. Administrators must treat this as a high-priority incident and remove the affected theme from production environments immediately, as unauthorized access to the underlying server environment is a likely outcome of successful exploitation.

Description Summary:
AncoraThemes Exit Game is vulnerable to Local File Inclusion due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the AncoraThemes Exit Game WordPress theme poses a significant risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-53429

Affected Software: AncoraThemes Exit Game

Affected Versions: 0 through 1.4.3

Vulnerability: The theme suffers from a PHP Local File Inclusion vulnerability, classified as CWE-98, which occurs due to insufficient sanitization of filenames passed to include or require statements. The CVSS vector indicates this is an unauthenticated vulnerability that can be triggered over the network without user interaction.

Business Impact

The ability to perform Local File Inclusion allows an attacker to read sensitive files from the underlying server, including configuration files, credentials, and source code. Given the CVSS score of 8.1, this vulnerability presents a high risk of total system impact, potentially leading to unauthorized data exposure and total loss of confidentiality, integrity, and availability of the affected WordPress instance.

Remediation Plan

Immediate Action: Since a specific patch is not currently identified, users should immediately deactivate or uninstall the Exit Game theme until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or attempts to access sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common file inclusion and directory traversal attack patterns to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of an available patch increases risk, the CVSS vector notes a High complexity requirement, which necessitates specific conditions for a successful attack.

Analyst Recommendation

The vulnerability represents a severe security flaw that could allow an attacker to read arbitrary files on the server. Because the vulnerability is unauthenticated and affects the core functionality of the theme, administrators must prioritize the removal of the vulnerable software or the application of vendor updates immediately upon availability.

Description Summary:
A Local File Inclusion vulnerability exists in the AncoraThemes Faith & Hope WordPress theme, allowing attackers to manipulate file paths in include statements.

Executive Summary:
The AncoraThemes Faith & Hope theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary local files on the server.

Vulnerability Details

CVE-ID: CVE-2025-52768

Affected Software: AncoraThemes Faith & Hope

Affected Versions: 0 through 2.13.0

Vulnerability: This flaw, categorized as CWE-98, involves improper control of filenames used in PHP include or require statements. An unauthenticated attacker can leverage this to perform Local File Inclusion, potentially accessing sensitive files or executing arbitrary code on the underlying host.

Business Impact

A successful exploit poses a critical risk to business operations, as it could lead to full system compromise, unauthorized access to sensitive configuration files, or the execution of malicious scripts. With a CVSS score of 8.1, the vulnerability is classified as High severity, reflecting the significant potential for confidentiality, integrity, and availability loss.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the latest security update and apply it immediately to the WordPress environment. If an official fix is not yet available for your specific installation, consider switching to an alternative, secure theme until a patch is released.

Proactive Monitoring: Monitor server access logs for suspicious file path patterns or attempts to include unexpected PHP files, particularly those originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common directory traversal and file inclusion attack signatures, which can mitigate the risk while a permanent patch is pending.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific conditions, the nature of Local File Inclusion makes this a high-value target for attackers looking to gain server-level access.

Analyst Recommendation

Given the high CVSS score and the potential for full server compromise, administrators must prioritize the remediation of this vulnerability. Organizations should verify their current version of the Faith & Hope theme and apply the vendor update as soon as it becomes available to ensure the integrity and security of their web infrastructure.

Description Summary:
The Agrico theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Farm Agrico theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-52745

Affected Software: AncoraThemes Farm Agrico

Affected Versions: 0 through 1.3.11

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw where an unauthenticated attacker can manipulate filename parameters to include unauthorized files, leading to high confidentiality, integrity, and availability impact.

Business Impact

Successful exploitation allows an attacker to access sensitive configuration files or execute arbitrary code, which could lead to a full compromise of the underlying WordPress installation. Given the CVSS score of 8.1, this represents a high-risk security event that could result in data exfiltration or complete loss of system control.

Remediation Plan

Immediate Action: Since no specific patch version is confirmed, users should immediately disable or remove the Agrico theme if it is not business-critical, or contact the vendor for an emergency security update.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized PHP include requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for specific input manipulation suggests that while not currently weaponized, it remains a significant risk if the theme is exposed to untrusted input.

Analyst Recommendation

The severity of this Local File Inclusion vulnerability necessitates immediate attention from administrators responsible for environments using the Agrico theme. Because the vulnerability is unauthenticated, it poses a direct risk to public-facing systems. We recommend auditing all WordPress installations for the presence of this theme and applying the strictest access controls until a confirmed vendor patch is released and verified.

Description Summary:
The AncoraThemes Femme theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements, allowing potential unauthorized file access.

Executive Summary:
A critical local file inclusion vulnerability in the AncoraThemes Femme theme may allow unauthenticated attackers to access sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-49943

Affected Software: AncoraThemes Femme

Affected Versions: 0 through 1.3.11

Vulnerability: This flaw is classified as a Local File Inclusion (CWE-98) occurring within the theme's PHP codebase. An unauthenticated attacker can manipulate filename parameters to include local files, leading to full compromise of confidentiality, integrity, and availability.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational security, as it allows attackers to read sensitive configuration files or execute arbitrary code. Given the CVSS score of 8.1, this represents a high-severity threat that could lead to complete system takeover, unauthorized data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Review the Patchstack advisory for potential updates and ensure the theme is removed or disabled if a patch is not yet provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal sequences or attempts to access non-public PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, the requirement for specific environmental conditions to trigger the inclusion may limit immediate mass exploitation.

Analyst Recommendation

Organizations utilizing the AncoraThemes Femme theme must act immediately to mitigate this risk. Given the potential for total system impact, verify the current version in use and prioritize the removal of the theme if a secure version is unavailable. Security teams should maintain heightened vigilance for suspicious web traffic until the software is updated or replaced.

Description Summary:
The Gardis WordPress theme is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate file paths in include statements.

Executive Summary:
The AncoraThemes Gardis WordPress theme contains a critical local file inclusion vulnerability that permits unauthenticated attackers to access or execute arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-49942

Affected Software: AncoraThemes Gardis

Affected Versions: 0 through 1.2.13

Vulnerability: This flaw is classified as a Local File Inclusion (CWE-98) occurring due to improper control of filenames in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform local file inclusion poses a severe risk to organizational security, as it can lead to full server compromise, the exposure of sensitive configuration files, or remote code execution. With a CVSS score of 8.1, this vulnerability is categorized as High, representing a significant threat to data integrity, confidentiality, and overall system availability.

Remediation Plan

Immediate Action: Users should immediately deactivate or remove the affected Gardis theme until a security update is released and verified by the vendor.

Proactive Monitoring: Security teams should audit web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths targeting PHP includes.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block common file inclusion and directory traversal payloads to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high given that it requires no authentication to trigger, making it an attractive target for automated scanning tools.

Analyst Recommendation

Given the severity of potential file inclusion attacks, administrators must treat this vulnerability with high priority. Since no patch is currently confirmed, immediate deactivation of the Gardis theme is the only effective way to eliminate the risk of unauthorized file access and potential code execution.

Description Summary:
The GlamChic theme for WordPress contains a Local File Inclusion vulnerability due to improper filename control in include statements, allowing unauthenticated attackers to potentially read sensitive files.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the AncoraThemes GlamChic WordPress theme allows unauthenticated attackers to compromise sensitive system information.

Vulnerability Details

CVE-ID: CVE-2025-49941

Affected Software: AncoraThemes GlamChic

Affected Versions: 0 through 1.0.11

Vulnerability: The theme fails to properly sanitize filenames used in PHP include or require statements. This allows an unauthenticated attacker to supply malicious input to trigger Local File Inclusion, potentially leading to the disclosure of sensitive server files or execution of arbitrary local code.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the WordPress environment. Given the CVSS score of 8.1, the potential for unauthorized file access and remote code execution could lead to full system compromise, data exfiltration, and severe operational downtime.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate the GlamChic theme until the vendor releases a security update. If the theme must remain active, ensure that all directory traversal attempts are blocked at the server level.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences or attempts to access configuration files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious include path parameters or directory traversal characters (e.g., ../) directed at the theme files.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for specific input manipulation makes it a high-priority target for automated scanning and exploitation attempts.

Analyst Recommendation

Given the high CVSS severity and the potential for total system impact, this vulnerability must be addressed with urgency. Organizations using the GlamChic theme should verify their version immediately and apply the vendor's security guidance as soon as it becomes available to prevent unauthorized access.

Description Summary:
The AncoraThemes Strux theme is vulnerable to local file inclusion, allowing an unauthenticated attacker to manipulate file paths and potentially execute arbitrary PHP code.

Executive Summary:
An unauthenticated local file inclusion vulnerability in the AncoraThemes Strux theme poses a significant risk of full system compromise via arbitrary file access or execution.

Vulnerability Details

CVE-ID: CVE-2025-49371

Affected Software: AncoraThemes Strux

Affected Versions: 0 through 1.9

Vulnerability: This vulnerability, categorized as CWE-98, stems from improper control of filenames used in PHP include or require statements, which allows an unauthenticated attacker to perform local file inclusion.

Business Impact

The ability to include arbitrary local files enables an attacker to read sensitive configuration files, such as database credentials, or execute malicious code on the server. Given the CVSS score of 8.1, this flaw presents a high risk to confidentiality, integrity, and availability, potentially leading to a complete takeover of the WordPress instance and lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, users should immediately deactivate or remove the Strux theme if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious requests containing path traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the requirement for specific configuration knowledge makes exploitation more complex for attackers.

Analyst Recommendation

The vulnerability in the AncoraThemes Strux theme is severe and warrants immediate attention. Administrators must prioritize identifying all instances of the affected software and implementing the recommended compensating controls or removal strategies until an official vendor update is verified and applied.

Description Summary:
A Local File Inclusion vulnerability in the AncoraThemes Lymcoin theme allows unauthenticated attackers to manipulate file paths during inclusion statements.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Lymcoin theme poses a severe risk of unauthorized file access and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-49370

Affected Software: AncoraThemes Lymcoin

Affected Versions: 0 through 1.3.12

Vulnerability: This flaw is a Local File Inclusion (CWE-98) occurring due to improper control of filenames in PHP include or require statements. It allows an unauthenticated remote attacker to include arbitrary local files on the server.

Business Impact

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, credentials, or other internal data residing on the web server. Given the CVSS score of 8.1, the potential for total compromise of the application environment is significant, which could result in severe reputational damage and unauthorized access to backend systems.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the Lymcoin theme and apply all available security updates or patches provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious patterns involving path traversal sequences, such as dot-dot-slash characters, targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal and file inclusion attack signatures.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's requirement for specific file path manipulation makes it a targeted vector for attackers seeking to bypass application logic.

Analyst Recommendation

The high CVSS severity highlights the critical nature of this flaw, as it allows unauthenticated interaction with the server file system. Administrators should prioritize upgrading the Lymcoin theme to the latest secure version immediately to eliminate the underlying vulnerability and prevent potential exploitation.

Description Summary:
AncoraThemes Lettuce contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Lettuce WordPress theme permits unauthenticated attackers to potentially read sensitive files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-49369

Affected Software: AncoraThemes Lettuce

Affected Versions: 0 through 1.1.7

Vulnerability: The vulnerability is a PHP Local File Inclusion (CWE-98) flaw that allows an unauthenticated attacker to manipulate input parameters to include arbitrary local files. The flaw resides in the theme's handling of include or require statements, which lacks sufficient validation of user-supplied filenames.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive configuration files, source code, or other data hosted on the server, which can lead to full system compromise. With a CVSS score of 8.1, this represents a significant risk to data confidentiality and integrity. The ability to execute arbitrary PHP code through inclusion could result in complete site takeover and persistent backdoors.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the Lettuce theme if it is not business-critical, or monitor the vendor for the release of a security update that addresses this inclusion flaw.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing path traversal sequences or attempts to access common sensitive files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and directory traversal attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for total impact on confidentiality, integrity, and availability, even if the attack complexity is higher than typical remote code execution flaws.

Analyst Recommendation

Given the potential for complete system compromise, administrators must treat this vulnerability with high urgency. If an update is not yet available from AncoraThemes, the most effective mitigation is to disable the affected theme entirely to prevent unauthorized file access until a verified fix is deployed.

Description Summary:
A local file inclusion vulnerability in the AncoraThemes Palladio theme allows unauthenticated attackers to manipulate include statements.

Executive Summary:
An unauthenticated local file inclusion vulnerability in the AncoraThemes Palladio theme poses a high risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-49368

Affected Software: AncoraThemes Palladio

Affected Versions: 0 through 1.1.10

Vulnerability: This flaw is a local file inclusion vulnerability, stemming from improper control of filenames used in PHP include or require statements. An unauthenticated attacker can leverage this weakness to include arbitrary files on the server, potentially leading to unauthorized data exposure or code execution.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high severity due to the potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code, leading to complete site compromise, data theft, and significant operational disruption.

Remediation Plan

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately disable or uninstall the Palladio theme if it is not strictly required for business operations. If the theme must remain active, contact the vendor or monitor official channels for an urgent security update.

Proactive Monitoring: Review web server access logs for anomalous requests, particularly those containing directory traversal patterns or unexpected file path references. Monitor for unusual PHP error logs that may indicate failed inclusion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious file inclusion patterns. Ensure that the web server process runs with the least privilege necessary to limit the scope of potential file access.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a public exploit reduces immediate risk, the nature of local file inclusion vulnerabilities makes them high-value targets for attackers seeking to gain unauthorized access to server-side content.

Analyst Recommendation

Given the high severity of this file inclusion vulnerability, organizations should treat this as a priority item. If an official update is not available from AncoraThemes, the most effective mitigation is to deactivate the theme or transition to an alternative solution. Organizations must maintain a heightened state of vigilance until a vendor-supplied patch is applied and verified.

Description Summary:
AncoraThemes Monyxi contains a PHP Local File Inclusion vulnerability due to improper control of filenames used in include statements. This flaw allows unauthenticated remote attackers to include local files.

Executive Summary:
The AncoraThemes Monyxi theme is vulnerable to local file inclusion, which could allow an unauthenticated attacker to execute arbitrary PHP code or access sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2025-49367

Affected Software: AncoraThemes Monyxi

Affected Versions: 0 through 1.1.8

Vulnerability: The vulnerability is a PHP Local File Inclusion (CWE-98) occurring because the application fails to properly sanitize user input before using it in an include or require statement. This flaw is exploitable by unauthenticated attackers over the network.

Business Impact

A successful exploit allows an attacker to read arbitrary files from the server, potentially exposing configuration files, credentials, or source code. Furthermore, if the attacker can influence the content of the included file, they may achieve remote code execution, leading to a complete compromise of the WordPress installation and the underlying server. With a CVSS score of 8.1, this is a High severity issue that requires immediate attention to prevent unauthorized access and data breaches.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or contact AncoraThemes for the latest security update.

Proactive Monitoring: Monitor server access logs for requests containing path traversal sequences or attempts to include unexpected file types, such as .php, .txt, or .log files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The high complexity score in the CVSS vector suggests that exploitation may require specific environmental conditions, but the impact remains critical.

Analyst Recommendation

Given the potential for remote code execution and the lack of a verified patch, users should treat this vulnerability with high urgency. If an official update is not available from the vendor, the most effective mitigation is to deactivate and remove the Monyxi theme until the developer provides a secure version. Regular backups and strict filesystem permissions should be maintained as a baseline defense against this and similar file inclusion threats.

Description Summary:
The Hanani WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the AncoraThemes Hanani WordPress theme allows attackers to potentially access sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-49366

Affected Software: AncoraThemes Hanani

Affected Versions: 0 through 1.2.11

Vulnerability: This vulnerability is categorized as CWE-98, involving the improper control of filenames for include statements within the PHP code. An unauthenticated attacker can exploit this flaw to perform Local File Inclusion, which may lead to unauthorized data disclosure or system compromise.

Business Impact

The severity of this vulnerability is high, as reflected by the CVSS score of 8.1. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code, leading to a total compromise of the affected WordPress instance, potential data exfiltration, and significant reputational damage to the organization hosting the site.

Remediation Plan

Immediate Action: Review the vendor advisory for the release of a security patch and update the Hanani theme to the latest version immediately upon availability.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal sequences or attempts to access system files, such as etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious file path patterns or directory traversal attempts targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on improper include handling makes it a critical target for attackers seeking to bypass application logic.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise, this vulnerability poses a significant risk to any environment running the Hanani theme. Administrators must prioritize identifying all instances of this theme and ensuring they are updated as soon as the vendor provides a remediation path. If an update is not yet available, consider temporarily deactivating the theme to mitigate the risk of unauthorized access.

Description Summary:
The AncoraThemes Jack Well WordPress theme is vulnerable to Local File Inclusion due to improper control of filenames used in PHP include or require statements.

Executive Summary:
A critical Local File Inclusion vulnerability in the AncoraThemes Jack Well theme allows unauthenticated attackers to potentially execute arbitrary local files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-49365

Affected Software: AncoraThemes Jack Well

Affected Versions: 0 through 1.0.14

Vulnerability: The flaw, categorized as CWE-98, stems from the improper handling of user-supplied input within include or require statements in the PHP code. This vulnerability allows an unauthenticated attacker to manipulate file paths to include unintended local files, which may lead to sensitive data exposure or remote code execution.

Business Impact

The ability to perform Local File Inclusion poses a severe risk to the confidentiality, integrity, and availability of the web application. Successful exploitation could allow an attacker to read sensitive configuration files or execute malicious PHP code, potentially leading to a full compromise of the underlying server infrastructure. Given the CVSS score of 8.1, organizations should treat this as a high-priority security event.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, users should disable or switch to an alternative theme until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block directory traversal attempts and unexpected file inclusion patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically severe, its exploitability depends on the specific implementation of the include functions within the theme.

Analyst Recommendation

The severity of this Local File Inclusion vulnerability necessitates immediate attention from administrators responsible for environments utilizing the Jack Well theme. Organizations must prioritize the identification of affected installations and apply temporary mitigation strategies, such as deactivating the theme, until the vendor provides a secure version update.

Description Summary:
The AncoraThemes Ludos Paradise WordPress theme contains a Local File Inclusion vulnerability due to improper handling of filenames in include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Ludos Paradise theme exposes systems to potential unauthorized file access and code execution.

Vulnerability Details

CVE-ID: CVE-2025-49364

Affected Software: AncoraThemes Ludos Paradise

Affected Versions: 0 through 2.1.3

Vulnerability: This vulnerability is a PHP Local File Inclusion (LFI) flaw stemming from improper control of filenames used in include or require statements. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates that this is an unauthenticated vulnerability reachable over the network, although it requires specific conditions to trigger.

Business Impact

The ability to perform local file inclusion can lead to the exposure of sensitive configuration files, credentials, or source code stored on the web server. Given the CVSS score of 8.1, this flaw poses a significant risk to data confidentiality and system integrity, as attackers may be able to leverage the inclusion to execute arbitrary code or gain broader control over the WordPress environment.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, users should monitor the AncoraThemes official support channels for an update and consider temporarily disabling the theme if it is not business-critical.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as directory traversal characters or unexpected file path inclusions, originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common LFI attack patterns, such as attempts to access sensitive system files like wp-config.php or /etc/passwd.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically dangerous, the requirement for specific environmental conditions and the lack of observed exploitation suggest a moderate immediate risk.

Analyst Recommendation

This vulnerability represents a significant security risk for installations using the Ludos Paradise theme. Administrators must prioritize identifying all instances of this theme and ensuring they are prepared to update as soon as a security patch is released by the vendor. In the interim, ensure that the principle of least privilege is applied to the web server user to limit the potential impact of a successful file inclusion attack.

Description Summary:
A Local File Inclusion vulnerability in the AncoraThemes Kings & Queens WordPress theme allows unauthenticated attackers to include arbitrary local files via improper filename control.

Executive Summary:
A critical Local File Inclusion vulnerability in the AncoraThemes Kings & Queens theme exposes the server to unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-49363

Affected Software: AncoraThemes Kings & Queens

Affected Versions: 0 through 1.1.16

Vulnerability: This flaw is classified as CWE-98, representing improper control of filenames in PHP include statements. An unauthenticated attacker can leverage this to perform Local File Inclusion (LFI), potentially reading sensitive configuration files or executing arbitrary code on the underlying server.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high risk of total system compromise, including unauthorized data exposure, integrity loss, and availability disruption. Successful exploitation allows an attacker to bypass standard application access controls to interact with sensitive server-side files, leading to significant reputational damage and potential regulatory non-compliance regarding data privacy.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should immediately disable the Kings & Queens theme or switch to an alternative theme until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or references to sensitive files like etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized file inclusion attempts targeting the theme directory.

Exploitation Status

Public Exploit Available: No (Exploit status is unknown; no confirmed public weaponized exploit or PoC exists in the analyzed data).

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw, however, makes it a high-value target for automated scanners searching for vulnerable WordPress installations.

Analyst Recommendation

Given the high CVSS severity and the potential for full system compromise via Local File Inclusion, this vulnerability poses a significant threat to organizational security. IT administrators must treat this as a high-priority incident, ensuring the affected theme is removed or restricted until the vendor provides a verified security update. Continuous monitoring of web logs remains essential to detect any early signs of probing or exploitation.

Description Summary:
The AncoraThemes Gracioza WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in PHP include or require statements.

Executive Summary:
An unauthenticated local file inclusion vulnerability in the AncoraThemes Gracioza theme allows attackers to read arbitrary files or execute malicious code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-49362

Affected Software: AncoraThemes Gracioza

Affected Versions: 0 through 1.0.15

Vulnerability: This is a local file inclusion (CWE-98) vulnerability triggered by improper handling of user-supplied input in include or require statements. An unauthenticated attacker can manipulate these paths to include arbitrary files from the local filesystem.

Business Impact

The ability to include local files can lead to full system compromise, including the exposure of sensitive configuration files or the execution of arbitrary PHP code. Given the CVSS score of 8.1, this is a high-severity flaw that poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation may result in unauthorized access to database credentials and complete site takeover.

Remediation Plan

Immediate Action: Check the vendor website for security updates and apply them immediately. If no official patch is available, consider switching to an alternative theme until the vulnerability is addressed.

Proactive Monitoring: Monitor server access logs for unusual file path requests, such as those containing directory traversal sequences like double dots or references to system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and file inclusion attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation requires specific conditions, the nature of the flaw makes it highly dangerous if the application environment permits arbitrary file access.

Analyst Recommendation

This vulnerability represents a critical security gap that could allow an attacker to bypass standard authentication and gain control over the web server. Administrators should prioritize identifying instances of the Gracioza theme within their environment and restrict access to the affected components until a verified vendor patch is applied.

Description Summary:
The AncoraThemes Mamita WordPress theme contains a local file inclusion vulnerability due to improper control of filenames in include or require statements.

Executive Summary:
The AncoraThemes Mamita WordPress theme is vulnerable to local file inclusion, which could allow an unauthenticated attacker to execute arbitrary PHP code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-49361

Affected Software: AncoraThemes Mamita

Affected Versions: 0 through 1.0.9

Vulnerability: This vulnerability, identified as CWE-98, involves an improper control of filenames used in include or require statements within the theme. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

The severity of this vulnerability is high, with a CVSS score of 8.1, primarily due to the potential for total system compromise. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code on the web server, resulting in complete loss of confidentiality, integrity, and availability. This risk is particularly acute for organizations hosting sensitive customer data or proprietary applications on the affected WordPress instance.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate the Mamita theme until a secure version is released by AncoraThemes.

Proactive Monitoring: Security teams should review web server access logs for requests containing suspicious path traversal patterns or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious input directed at PHP include parameters.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in our curated sources.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is not currently confirmed, the nature of local file inclusion flaws often presents a high risk of automated scanning and exploitation by malicious actors.

Analyst Recommendation

Given the potential for complete system compromise, immediate deactivation of the vulnerable Mamita theme is the most prudent course of action. Organizations should monitor the vendor advisory for updates and ensure that their security posture includes robust egress filtering and file integrity monitoring to detect unauthorized modifications to the web directory.

Description Summary:
The AncoraThemes Militarology WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AncoraThemes Militarology theme could allow an unauthenticated attacker to execute arbitrary code or access sensitive files.

Vulnerability Details

CVE-ID: CVE-2025-49360

Affected Software: AncoraThemes Militarology

Affected Versions: 1.0.15 and prior

Vulnerability: The vulnerability is caused by CWE-98, where the application fails to properly sanitize user input before passing it to include or require statements. This flaw allows an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment. An attacker could read sensitive system files, configuration files, or execute malicious PHP code, which could result in a full site compromise. Given the CVSS score of 8.1, this represents a high risk that requires immediate attention to prevent unauthorized access or system takeover.

Remediation Plan

Immediate Action: Since a specific patch is not confirmed, administrators should immediately switch to a different, secure theme or deactivate the Militarology theme until a fix is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected PHP file inclusion attempts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block directory traversal attempts and suspicious file inclusion payloads.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently known to be exploited in the wild, the nature of local file inclusion flaws makes them highly dangerous if discovered by malicious actors.

Analyst Recommendation

The severity of this vulnerability necessitates swift action despite the absence of confirmed public exploits. Because the flaw allows for potential remote code execution via local file inclusion, administrators should prioritize the removal or replacement of the affected theme. Ensure all security patches are applied as soon as the vendor provides an update to remediate this issue.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the AncoraThemes ShieldGroup theme allows attackers to include arbitrary files via improper filename control.

Executive Summary:
AncoraThemes ShieldGroup is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to read sensitive files or achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-49359

Affected Software: AncoraThemes ShieldGroup

Affected Versions: 0 through 2.13

Vulnerability: The theme suffers from improper control of filenames for include or require statements, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to manipulate file paths to include local files, potentially leading to full system compromise.

Business Impact

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.1, the risk of data theft and total system compromise is high, potentially resulting in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As there is no confirmed patch available, administrators should immediately deactivate or uninstall the ShieldGroup theme if it is not strictly necessary for business operations.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns, such as sequences of dot-dot-slash (../), which are indicative of LFI exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion patterns to mitigate the risk while awaiting a vendor security update.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the high attack complexity noted in the CVSS vector suggests that exploitation requires specific environmental conditions.

Analyst Recommendation

The vulnerability presents a significant risk to the integrity and confidentiality of the affected WordPress environment. Organizations currently utilizing the ShieldGroup theme must prioritize the immediate removal or restriction of the component until the vendor releases a security update addressing this flaw.