CVE-2026-112850: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in AncoraThemes Your Dress

The vulnerability CVE-2026-112850 affects AncoraThemes Your Dress up to version 1.4.1. It arises from improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker to execute arbitrary code or disclose sensitive information by including unintended files on the server. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution or disclosure of sensitive files on the server, compromising confidentiality, integrity, and availability of the affected application and potentially the underlying system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting vulnerable functionality and applying strict input validation to mitigate risk.