Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP Local File Inclusion.This issue affects uReach: from n/a through <= 1.3.3.
Published: 2026-01-22
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The uReach theme for WordPress contains an improper control of file names in include/require statements, allowing local file inclusion. Attackers could supply a crafted file path to read sensitive files on the server, or potentially execute arbitrary code if a writable directory is available. This vulnerability is classified as CWE‑98 and can compromise the confidentiality, integrity, and availability of the affected WordPress installation.

Affected Systems

AncoraThemes uReach theme for WordPress. All releases from the initial release up to and including version 1.3.3 are affected.

Risk and Exploitability

The severity score of 8.1 indicates a high‑risk vulnerability. The EPSS score is below 1%, suggesting there are currently few known exploits, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires that an attacker be able to influence the file name parameter used in the theme’s PHP code, which may be exposed through an exposed URL or form input. Despite the low exploitation probability, the high impact warrants prioritizing remediation.

Generated by OpenCVE AI on April 29, 2026 at 10:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the uReach theme to the latest available version that removes the flaw—currently any version newer than 1.3.3.
  • If an upgrade cannot be performed immediately, disable or remove the uReach theme and switch to a secure alternative to stop the vulnerable code from executing.
  • On the server side, set PHP’s allow_url_include to Off, limit file system permissions to prevent the web server from accessing sensitive directories, and configure web server rules to block directory traversal attempts.
  • If you have ability to modify the theme code, replace or guard the include/require calls with strict validation against a whitelist of allowed files or eliminate the dynamic include entirely.

Generated by OpenCVE AI on April 29, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 28 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP Local File Inclusion.This issue affects uReach: from n/a through <= 1.3.3.
Title WordPress uReach theme <= 1.3.3 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:37:49.870Z

Reserved: 2025-12-29T11:18:59.801Z

Link: CVE-2025-69060

cve-icon Vulnrichment

Updated: 2026-01-28T21:38:24.332Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T17:16:19.773

Modified: 2026-06-17T10:00:10.057

Link: CVE-2025-69060

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T10:30:09Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')