The vulnerability identified as CVE-2026-27340 affects the Apollo | Night Club, DJ Event WordPress Theme by AncoraThemes. It arises from improper control of the filename parameter in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive information. The issue affects versions up to and including 1.3.1. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive files, or disrupt service on the affected WordPress site. The high CVSS score (8.1) indicates a critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme to mitigate risk. Monitor official AncoraThemes communications for updates and apply patches promptly once available.