The vulnerability CVE-2026-27335 affects the AncoraThemes Ekoterra theme for WordPress, specifically versions up to 1.0.0. It arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. This can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to remote code execution or disclosure of sensitive files on the web server hosting the vulnerable theme. The attacker can compromise the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the impact is considered high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a patch is released, users should consider disabling or removing the vulnerable theme or applying manual code review and hardening to prevent inclusion of untrusted files. Monitor the vendor's official channels for updates and patches.