CVE-2026-112820: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Elated-Themes Academist Core

The vulnerability CVE-2026-112820 affects Elated-Themes Academist Core versions up to and including 1.4.1. It is caused by improper control of the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, and fully compromise the affected system's confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and consider disabling or restricting the affected functionality to mitigate risk.