What is the CVSS score of EUVD-2026-108954?

EUVD-2026-108954 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate EUVD-2026-108954?

Within 24 hours, identify all websites running the 'Your Dress' theme and check if version 1.4.1 or earlier is active; if so, take immediate action to disable or remove the theme, or apply temporary mitigations. Within 7 days, for any sites where the theme cannot be removed, implement a web application firewall (WAF) rule to block local file inclusion attempts targeting common sensitive files like wp-config.php, and restrict file permissions to minimize exposure. Within 30 days, replace the theme with a secure alternative, or if a patch becomes available, apply it promptly; conduct a security review of affected sites for signs of compromise and rotate database credentials if exposure is suspected.

Your Dress Theme EUVD-2026-108954

| CVE-2026-112850 HIGH

PHP Remote File Inclusion (CWE-98)

2026-10-23 Patchstack

GHSA-j623-hw67-6833

PHP WordPress Information Disclosure LFI Wordpress Theme Ancorathemes Your Dress

8.1

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach vulnerable theme endpoint
Delivery

Send crafted inclusion parameter
Exploit

Trigger PHP local file inclusion
Execution

Disclose or execute local file
Impact

Access sensitive data or code execution

Vulnerability Assessment

Weakness	CWE CWE-98 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V5 - File Handling File inclusion prevention, allowlisting MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The target must be a WordPress site running the AncoraThemes 'Your Dress' theme at version 1.4.1 or earlier. Per CVSS PR:N/UI:N, exploitation requires no authentication and no user interaction. The description does not name the exact vulnerable parameter, endpoint, or any required non-default configuration, and the AC:H rating implies some additional condition that the available sources do not specify - the precise trigger is not described in the available sources. The primary limiting factor is deployment: only sites with this specific theme installed and active are affected.
Impact	This is an unauthenticated, network-reachable PHP Local File Inclusion (CWE-98) in the AncoraThemes 'Your Dress' WordPress theme, rated CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The CVSS vector agrees with the description on network vector and no authentication (PR:N), but assigns AC:H - the available sources do not describe why exploitation complexity is high, so the specific trigger condition is not confirmed. No EPSS score, no CISA KEV listing, and no verified working exploit code were provided; the only reference is the Patchstack database advisory, not a proof-of-concept. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious but not actively-exploited flaw. Net assessment: a genuinely high-severity vulnerability for sites running this theme (unauthenticated file disclosure, potentially escalating to code execution for PHP inclusion), but real-world mass-exploitation risk is tempered by the theme's limited deployment footprint and the absence of any exploitation signal (no KEV, no EPSS, no confirmed PoC). Prioritize patching on the week-level timeline indicated rather than as an emergency.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted request to a vulnerable 'Your Dress' theme endpoint that passes attacker-influenced input into a PHP include/require statement, causing the server to include an unintended local file. This can disclose sensitive files (e.g., configuration or credentials) and, if attacker-controlled content can be included, may escalate to PHP code execution. No public exploit identified at time of analysis; the trigger mechanism is not described in the available sources.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 23, 2026

Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.

RemediationAI

No patched version is identified in the available data: 1.4.1 is recorded as the affected release and no successor is named, so there is no vendor-released patch to apply at this time. The most reliable action is to deactivate and remove the 'Your Dress' theme from any WordPress installation where it is not strictly required, accepting the loss of its presentation and any theme-specific functionality, and to check the Patchstack advisory page for a fixed release before reinstalling. Because the vulnerable parameter and endpoint are not documented, a targeted WAF or virtual-patch rule cannot be scoped with confidence and would need broad blocking of theme-directory PHP requests, which risks breaking legitimate theme assets. If the theme must remain active, treat the installation as potentially disclosing wp-config.php and rotate database credentials and WordPress salts as a precaution, while monitoring the advisory for an updated version.

Affected VersionsENISA

Your Dress 0 ≤1.4.1

Affected Packages

euvd your_dress no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is classified as CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program, the class that covers PHP local and remote file inclusion. PHP's include/require family resolves a filesystem path at runtime; when a theme builds that path from request-influenced input (a template-part name, an AJAX action parameter, or similar) without normalizing it against a fixed allowlist, an attacker can redirect the include to an arbitrary local file, and PHP will render or error out its contents. The CWE title references remote file inclusion, but the vendor advisory and tags (LFI, Information Disclosure) describe the realized outcome as disclosure of local files rather than execution of remote code, which matches the confidentiality-focused impact in our assessment. CPE coverage is recorded as cpe:2.3:a:ancorathemes:your_dress:*:*:*:*:*:*:*:* - a wildcard that spans all releases up to and including 1.4.1. The available sources do not name the vulnerable parameter, hook, or template endpoint, and the published vector's AC:H component implies an additional precondition that is not documented; the precise trigger is not described in the available sources. The primary limiting factor is deployment footprint: only WordPress installations with this AncoraThemes theme present and active expose the code path at all.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.5 HIGH

Unauthenticated network LFI (AV:N/PR:N); AC:L as no special condition is documented; primary impact is file disclosure (C:H), with I/A:N absent evidence of code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.

Executive ViewAI

Why It Matters

The AncoraThemes 'Your Dress' WordPress theme (versions up to 1.4.1) contains a high-severity local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive files like wp-config.php, exposing database credentials. Sites using this theme are at risk of data breach and full compromise, requiring immediate inventory and remediation since no vendor patch is currently available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include removing or disabling the vulnerable theme, deploying WAF rules to detect and block local file inclusion attempts, restricting file permissions on sensitive files such as wp-config.php, and monitoring for unauthorized access or data exfiltration.

Threat Intelligence Overview

EPSS Score

0.6%

Top 54% exploitable

Prevalence

Low

niche commercial WordPress theme, limited site-specific deployment

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Local File Inclusion HIGH

Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.