The vulnerability CVE-2026-27326 affects the AC Services WordPress theme by axiomthemes, specifically versions up to 1.2.5. It arises from improper validation or control over filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw can allow an attacker to include unintended files from the server, potentially leading to arbitrary code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official remediation guidance is currently available from the vendor or other sources.

Successful exploitation of this vulnerability can lead to full compromise of the affected system by allowing an attacker to execute arbitrary code or access sensitive files. The high CVSS score reflects the significant risk to confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme if possible. Monitoring for updates from axiomthemes or the WordPress theme repository is recommended to apply any forthcoming patches promptly.