CVE-2026-27340

Received Received - Intake

Local File Inclusion in AncoraThemes Apollo WordPress Theme

Publication date: 2026-03-05

Last updated on: 2026-03-09

Assigner: Patchstack

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Apollo | Night Club, DJ Event WordPress Theme apollo allows PHP Local File Inclusion.This issue affects Apollo | Night Club, DJ Event WordPress Theme: from n/a through <= 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-05

Last Modified

2026-03-09

Generated

2026-07-06

AI Q&A

2026-03-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27340

EUVD

EUVD-2026-9613

Affected Vendors & Products

Vendor	Product	Version / Range
ancorathemes	apollo	to 1.3.1 (inc)
ancorathemes	apollo	From 1.0 (inc) to 1.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-27340 is a Local File Inclusion (LFI) vulnerability in the WordPress theme "Apollo | Night Club, DJ Event" versions up to and including 1.3.1.'}, {'type': 'paragraph', 'content': 'This vulnerability allows unauthenticated attackers to include local files from the target website and display their contents.'}, {'type': 'paragraph', 'content': 'It arises from improper control of the filename used in PHP include/require statements.'}] [1]

Impact Analysis

[{'type': 'paragraph', 'content': 'Exploitation of this vulnerability can lead to exposure of sensitive information such as database credentials.'}, {'type': 'paragraph', 'content': "Depending on the website's configuration, attackers could achieve a complete database takeover."}, {'type': 'paragraph', 'content': 'This makes the vulnerability high priority with a CVSS severity score of 8.1.'}] [1]

Compliance Impact

I don't know

Detection Guidance

This vulnerability allows unauthenticated attackers to include local files from the target website, which can be detected by monitoring for suspicious HTTP requests attempting to exploit Local File Inclusion (LFI) in the Apollo WordPress theme.

While no specific commands are provided, detection can involve inspecting web server logs for requests containing unusual parameters or file paths that attempt to include local files.

Additionally, applying Patchstack’s mitigation rule can help block attacks targeting this vulnerability and can be used as a detection mechanism.

Mitigation Strategies

Since no official patch is currently available for this vulnerability, the immediate recommended step is to apply Patchstack’s mitigation rule to block attacks targeting this Local File Inclusion vulnerability.

Users should implement this mitigation immediately to protect their websites from potential exploitation.

Monitoring and restricting access to the affected theme versions (up to and including 1.3.1) and considering disabling or replacing the vulnerable theme until a patch is released are also advisable.

Hi! I’m here to help you understand CVE-2026-27340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70