AncoraThemes Your Dress: Local File Inclusion in WordPress theme
Summary
The Your Dress WordPress theme from AncoraThemes up to and including version 1.4.1 contains a Local File Inclusion vulnerability. An unauthenticated attacker can make the website load server files it should not access, which may expose configuration files such as database credentials and can lead to a takeover of the site. The vendor has not confirmed a fixed version, and no public exploit or known exploitation was found at the time of research.
Affected
- AncoraThemes Your Dress WordPress theme, versions up to and including 1.4.1
- Exact start of the affected range: unknown
Fixed in
- Unknown. No fixed version confirmed by the vendor or Patchstack.
Workaround
- Deactivate and remove the theme where it is not needed.
- Restrict who can upload or edit theme files.
- Ask the hosting provider or a web developer about WAF or virtual patching rules for this issue.
Exploitation
- Known exploitation: No (not in CISA KEV according to available trackers).
- Public proof of concept: None found.
- Patchstack rates it as high priority and expects exploitation; EPSS is low (about 0.3%).
- Authentication: not required. Attack complexity: high. User interaction: none.
Our recommendation
- Inventory all WordPress sites and check whether the Your Dress theme is installed and active.
- Deactivate and remove the theme on sites where it is not needed.
- Monitor the Patchstack advisory and the ThemeForest changelog for a fixed version and update once confirmed.
- Review web server logs for unusual requests to theme files and check for unexpected file changes.
- Verify backups and rotate database credentials if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress Your Dress theme local file inclusion patchstack.com
- NVD record mirror on Vulners vulners.com
- ThemeForest: Your Dress product page themeforest.net
- HOL Guard CVE entry hol.org
- VulDB entry vuldb.com
- CVE threatint record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:57.
Original description (NVD)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.