CVE-2026-112850 AncoraThemes CVE debrief

Who should care

WordPress administrators, security teams, and users of the Your Dress theme should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

This Local File Inclusion vulnerability in the Your Dress WordPress theme poses a significant risk to WordPress environments. Attackers could exploit this issue to access sensitive files, potentially leading to information disclosure or code execution. WordPress administrators and security teams should assess their exposure, apply patches or updates provided by AncoraThemes, and monitor for suspicious file inclusion attempts. The vulnerability's impact is heightened due to its potential for privilege escalation and the ease of exploitation. Evidence is limited, so verification of affected versions and exploitation is necessary.

• Sensitive information disclosure
• Potential code execution through file inclusion
• Increased risk of privilege escalation
• Need for urgent patching and verification

Technical summary

The Your Dress theme for WordPress version 1.4.1 and earlier contains a Local File Inclusion vulnerability. This vulnerability allows attackers to include local files, potentially leading to sensitive information disclosure or code execution. The issue arises from improper control of filename for include/require statements in PHP programs.

Defensive priority

High priority for WordPress administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of Your Dress theme version 1.4.1 and earlier in WordPress environments
• Apply patches or updates provided by AncoraThemes
• Monitor for suspicious file inclusion attempts
• Review and restrict file inclusion functionality in PHP applications

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation and impact is limited. There is no evidence of public exploitation, but defenders should verify affected versions, review PHP application logs for suspicious file inclusion attempts, and monitor for changes to file permissions or unexpected file accesses. Limited source information is available, so defensive verification is crucial.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.