Your Dress
Monthly
Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.
Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.