The vulnerability CVE-2026-27340 in AncoraThemes Apollo | Night Club, DJ Event WordPress Theme (versions up to 1.3.1) is due to improper control of the filename parameter in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include local files on the server, potentially resulting in arbitrary code execution or information disclosure. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code or access sensitive files on the affected server, compromising confidentiality, integrity, and availability of the system. The high CVSS score indicates serious potential damage. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable theme or applying manual code review and hardening to prevent inclusion of arbitrary files. Monitor official AncoraThemes communications for updates.