CVE-2026-112820 Elated-Themes CVE debrief

Who should care

Defenders responsible for WordPress deployments using the Academist Core plugin should assess exposure and prioritize patching or mitigation due to the potential for unauthorized access and data breaches. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

Defenders should prioritize verifying exposure of WordPress Academist Core plugin versions up to 1.4.1 and applying patches or mitigations as available due to the potential for unauthorized access and data breaches.

• Potential unauthorized access to local files
• Possible elevation of privileges
• Potential data breaches or modifications

Technical summary

The WordPress Academist Core plugin versions up to 1.4.1 are vulnerable to Local File Inclusion due to improper control of filename for include/require statement in PHP program. This issue affects Academist Core: from n/a through 1.4.1. The vulnerability may allow attackers to access local files, potentially leading to unauthorized access and data breaches. Defenders should prioritize verifying exposure and applying patches or mitigations as available. The CVE record and source item provide details on the vulnerability, but specific details on exploitation and remediation are limited.

Defensive priority

Defenders should prioritize verifying exposure of WordPress Academist Core plugin versions up to 1.4.1 and applying patches or mitigations as available.

Recommended defensive actions

• Verify exposure of WordPress Academist Core plugin versions up to 1.4.1
• Apply patches or mitigations as available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the Local File Inclusion vulnerability in WordPress Academist Core plugin versions up to 1.4.1. However, specific details on exploitation, impact, and remediation are limited. Defenders should verify exposure and apply patches or mitigations as available. The source confidence is limited, and further verification is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.