CleanSkin Theme CVE-2026-42724

The affected component is the CleanSkin WordPress theme (AncoraThemes) at versions 1.5.0 and earlier; a WordPress site running this theme must be deployed and internet-reachable. The vector is unauthenticated (PR:N) with no user interaction (UI:N), but AC:H indicates a limiting precondition the attacker does not fully control - the Patchstack advisory does not disclose the exact vulnerable parameter, endpoint, or configuration state required, so the precise trigger is unconfirmed. Practical limiting factors: the specific theme must be active (not merely installed), the deployment must expose the vulnerable code path, and the elevated complexity suggests a non-trivial or conditional requirement (e.g., a particular setting, timing, or server configuration) rather than a trivially repeatable request against defaults.

Signals conflict and should temper the 8.1 'High' score. The CVSS vector (AV:N/PR:N/UI:N) confirms a remotely reachable, unauthenticated flaw with full C/I/A impact, which drives the high base score - but AC:H explicitly flags that exploitation is NOT straightforward and depends on conditions outside the attacker's control, meaning reliable exploitation is harder than the headline number implies. No EPSS score was provided, so statistical exploitation probability cannot be weighed. There is no CISA KEV listing and no public exploit (POC) referenced - only a single Patchstack advisory - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data (automatable, exploitation, technical impact) was supplied. Net: this is a credible unauthenticated file-inclusion bug in a WordPress theme, but the combination of AC:H, no known exploitation, no POC, and a niche affected product places it below internet-facing drop-everything priority - patch on a normal cadence unless CleanSkin is confirmed in your estate. Note that CWE-98 (PHP remote/local file inclusion) combined with I:H/A:H suggests Patchstack judged the flaw capable of escalating to code execution (e.g., via log poisoning or wrapper abuse), but the advisory text does not confirm the escalation path.

A remote, unauthenticated attacker crafts a request to a vulnerable CleanSkin theme endpoint that passes attacker-influenced input into a PHP include/require path, causing the server to include a local file (and potentially attacker-staged content). The AC:H rating indicates success is conditional - the attacker likely must satisfy a non-default state or win a specific condition - and no public proof-of-concept was referenced at the time of analysis.