CVE-2026-27336: Consultor WordPress Theme Path Traversal

CVE-2026-27336 Overview

CVE-2026-27336 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Consultor WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. It affects all versions of the Consultor theme up to and including 1.2.4. Attackers can leverage the issue to include arbitrary local files into PHP execution context, leading to disclosure of sensitive data and potential code execution.

The vulnerability is reachable over the network without authentication, though successful exploitation requires specific conditions to be met. The Consultor theme is marketed for consulting, accounting, and legal services websites built on WordPress.

Critical Impact
Unauthenticated attackers can include arbitrary local PHP files, exposing configuration secrets and potentially achieving remote code execution on affected WordPress sites.

Affected Products

AncoraThemes Consultor WordPress Theme versions up to and including 1.2.4
WordPress installations using the Consultor theme for consulting, accounting, or legal services
Sites running the vulnerable theme alongside log files, upload directories, or session files that can be leveraged as inclusion targets

Discovery Timeline

2026-03-05 - CVE-2026-27336 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-27336

Vulnerability Analysis

The Consultor theme passes user-controllable input into a PHP include or require statement without adequate validation or sanitization. PHP File Inclusion vulnerabilities allow attackers to influence the path resolved by the inclusion call. When the included file is interpreted as PHP, any code it contains executes within the application context.

The vulnerability is classified under [CWE-98], which covers improper control of filename for include and require statements. While the CWE name historically references Remote File Inclusion, the practical impact here is Local File Inclusion based on the advisory description.

According to Patchstack, the affected range extends from unspecified earlier versions through 1.2.4. The EPSS probability is 0.172% as of the most recent scoring date.

Root Cause

The root cause is missing or insufficient validation on a filename parameter that flows into a PHP inclusion call. The theme likely concatenates an attacker-controlled value into a file path used by include, include_once, require, or require_once. Without an allow-list of permitted files or strict path normalization, attackers can break out of the expected directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker crafts an HTTP request to the vulnerable endpoint with a manipulated parameter pointing to a local file. The high attack complexity reflects environmental conditions that must align for exploitation, such as the presence of writable or attacker-controlled local content suitable for inclusion.

Common exploitation chains pair LFI with log poisoning, session file injection, or PHP wrappers such as php://filter to read source code or achieve code execution. See the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-27336

Indicators of Compromise

HTTP requests to Consultor theme endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Request parameters referencing sensitive system paths including /etc/passwd, wp-config.php, or PHP session directories
Use of PHP stream wrappers in query strings, such as php://filter, php://input, or data://
Unexpected PHP errors in web server logs referencing include() or require() failures with attacker-supplied paths

Detection Strategies

Inspect web server access logs for anomalous parameter values targeting theme files under /wp-content/themes/consultor/
Deploy web application firewall (WAF) rules to flag traversal patterns and PHP wrapper schemes in query strings and POST bodies
Correlate WordPress PHP error logs with request logs to identify failed inclusion attempts that may indicate reconnaissance

Monitoring Recommendations

Continuously monitor file integrity on the WordPress installation, particularly within wp-content/themes/consultor/
Alert on outbound connections from the web server process to unexpected destinations, which may indicate post-exploitation activity
Track creation of new PHP files in upload directories that could be staged as inclusion targets

How to Mitigate CVE-2026-27336

Immediate Actions Required

Identify all WordPress sites running the AncoraThemes Consultor theme and confirm the installed version
Take vulnerable sites offline or place them behind a restrictive WAF policy until patched
Rotate WordPress secrets, database credentials, and API keys referenced in wp-config.php if exploitation is suspected
Review web server and application logs for inclusion attempts dating back to theme installation

Patch Information

At the time of NVD publication, the advisory lists versions through 1.2.4 as affected with no fixed version explicitly identified. Administrators should consult the Patchstack WordPress Vulnerability advisory and the AncoraThemes vendor channel for the latest patched release and apply it immediately upon availability.

Workarounds

Restrict access to the vulnerable theme endpoints using WAF rules that block path traversal and PHP wrapper patterns
Set the PHP directive allow_url_include to Off and configure open_basedir to constrain accessible filesystem paths
Disable or replace the Consultor theme with a maintained alternative until a fix is published
Apply virtual patching through a WordPress security plugin that can block known LFI payloads

bash

# Configuration example: restrict PHP file inclusion via php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Example WAF rule pattern (ModSecurity) to block traversal in query strings
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|php://|data://|expect://)" \
    "id:1002736,phase:2,deny,status:403,msg:'Possible LFI attempt against Consultor theme'"