PHP EUVD-2026-15528

AncoraThemes Unica <= 1.4.1 with PHP Local File Inclusion vulnerability. Remote unauthenticated attacker can exploit via crafted requests manipulating filename parameters in include/require statements. AC:H suggests specific conditions or encoding required; no victim interaction needed.

While a CVSS score and vector are not provided in the vulnerability data, the risk assessment can be synthesized from available signals: this is an information disclosure vulnerability with a high real-world impact despite being limited to file reading rather than code execution. The attack vector is likely Network/Unauthenticated based on typical LFI patterns in WordPress themes, and attack complexity is Low, making this easily exploitable. The absence of CVSS, EPSS, and KEV status data does not diminish the practical risk—LFI vulnerabilities in widely-deployed WordPress themes are routinely exploited to extract wp-config.php files containing database credentials, which can lead to database compromise and site takeover. The fact that this affects all versions through 1.4.1 with no indication of a patch release suggests potential ongoing exposure for unpatched installations. The availability of public documentation via Patchstack indicates exploit methodology is known in the security community.

An attacker crafts a malicious HTTP request to the Unica theme, injecting a file path traversal payload into a vulnerable parameter (such as a page or template parameter). For example, a request like 'GET /wp-content/themes/unica/index.php?page=../../../../etc/passwd' could be used to read the server's passwd file, or 'GET /wp-content/themes/unica/?file=../../wp-config.php' could retrieve the WordPress configuration file containing database credentials and security keys. Since this is an unauthenticated network-accessible vulnerability with low attack complexity, exploitation requires minimal effort, and the attacker immediately gains access to sensitive local files without triggering typical code execution alerts, making detection more difficult than RFI attacks.