CVE-2026-27336: 
WordPress vulnerability analysis and mitigation

CVE-2026-27336 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Consultor WordPress theme (Consulting, Accounting & Legal Counsel). It affects all versions of the theme through 1.2.4 and was published on March 5, 2026, with the vulnerability originally reported on December 3, 2025 by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated network attackers under high-complexity conditions (Patchstack).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly referred to as PHP Remote File Inclusion, though in this case it manifests as Local File Inclusion. The flaw arises from insufficient validation of user-supplied input that is passed to PHP include or require statements within the theme, allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting specific conditions or non-default configurations must be met (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and execute arbitrary local PHP files on the server, potentially exposing sensitive files such as WordPress configuration files (e.g., wp-config.php) containing database credentials. This can lead to complete database takeover, unauthorized access to confidential data, modification of website content, and full compromise of the WordPress installation — all with high confidentiality, integrity, and availability impact (Patchstack).

As of the time of reporting, no public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Consultor theme (version ≤ 1.2.4) via passive fingerprinting tools (e.g., WPScan, Shodan, or BuiltWith) by detecting theme-specific assets in page source or HTTP headers.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) targeting the vulnerable endpoint, supplying a manipulated filename parameter (e.g., path traversal sequences like ../../../../wp-config.php) to reference a sensitive local file.
4. Retrieve sensitive data: The server processes the include statement and returns the contents of the targeted file (e.g., database credentials from wp-config.php) in the HTTP response.
5. Escalate access: Use retrieved credentials or execute included PHP files to achieve further compromise, such as database access, web shell deployment, or lateral movement within the hosting environment (Patchstack).

• Network: HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields targeting the Consultor theme endpoints; unusual outbound connections from the web server process.
• Logs: Web server access logs showing requests with encoded traversal patterns or references to sensitive files (e.g., wp-config.php, /etc/passwd) in parameter values; PHP error logs indicating failed or successful file inclusion of unexpected paths.
• File System: Presence of unexpected web shells or newly created PHP files in the WordPress theme directory (/wp-content/themes/consultor/); unauthorized modifications to theme files.
• Process: PHP or web server processes reading files outside the web root (e.g., /etc/passwd, /etc/shadow, or WordPress configuration files) as observed via system call monitoring tools.

As of the disclosure date, no official patch from AncoraThemes is available for the Consultor theme. Site administrators should immediately consider disabling or replacing the vulnerable theme with an alternative. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Additional workarounds include deploying a Web Application Firewall (WAF) with rules to block path traversal and file inclusion patterns, and enforcing strict input validation on all user-supplied parameters. Hosting providers should also consider restricting PHP's open_basedir setting to limit the files accessible via include statements (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of February 23 – March 1, 2026, indicating it received standard industry tracking attention. No notable vendor statements beyond Patchstack's advisory or significant researcher commentary beyond the original reporter (Tran Nguyen Bao Khanh, VCI - VNPT Cyber Immunity) have been identified. Community discussion appears limited, consistent with the absence of a public exploit and the niche nature of the affected theme (Wordfence).