The vulnerability CVE-2026-27336 affects the AncoraThemes Consultor | Consulting, Accounting & Legal Counsel WordPress theme up to version 1.2.4. It arises from improper control of filenames in PHP include or require statements, resulting in PHP Local File Inclusion. This can allow attackers to include and execute local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to arbitrary code execution, disclosure of sensitive information, and disruption of service on the affected web server running the vulnerable WordPress theme. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor AncoraThemes announcements for updates. Until a fix is available, consider disabling or removing the vulnerable theme to prevent exploitation.