CVE-2026-112850— WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
Quick assessment
Affected
AncoraThemes Your Dress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AncoraThemes 的 Your Dress（your-dress）插件存在 PHP 程序中包含/require 语句的文件名控制不当漏洞（即"PHP 远程文件包含”）。该问题导致攻击者可利用本地文件包含（LFI）进行攻击。受影响版本为 Your Dress 插件：从未知版本起至 1.4.1 版。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112850
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AncoraThemes | Your Dress | 0 ~ 1.4.1 | - |
|
II. Public POCs for CVE-2026-112850
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112850
请登录查看更多情报信息。
Other References for CVE-2026-112850 (1)
IV. Related Vulnerabilities
Same vendor: AncoraThemes
-
CVE-2026-78533
WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulner -
CVE-2026-66567
WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulne -
CVE-2026-66482
WordPress Drone Media theme <= 2.2.0 - PHP Object Injection -
CVE-2026-42724
WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vu -
CVE-2026-42723
WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vu
Same weakness: CWE-98
-
CVE-2026-112832
WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vu -
CVE-2017-20289
Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File I -
CVE-2026-112820
WordPress Academist Core plugin <= 1.4.1 - Local File Inclus -
CVE-2016-20101
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax -
CVE-2026-113402
ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
V. Comments for CVE-2026-112850
No comments yet