The vulnerability CVE-2026-27097 affects the CasaMia WordPress theme by AncoraThemes, allowing improper control over the filename parameter in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can potentially include local files on the server, possibly resulting in code execution or information disclosure. The issue affects versions up to and including 1.1.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor patch or advisory information currently available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary local files on the web server running the CasaMia theme, potentially leading to full compromise of the affected system. The high CVSS score reflects severe impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the vulnerable theme or restricting access to affected functionality to trusted users only. Monitor official AncoraThemes channels for updates and apply any official fixes promptly once released.