High
Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion
Multiple themes for WordPress by axiomthemes, ThemeRex, and AncoraThemes are vulnerable to Local File Inclusion in various versions. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| WordPress theme | Abogado - Lawyer WordPress Theme | < 1.18.0 | 1.18.0 |
| WordPress theme | Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor | <= 1.5.3 | no fix |
| WordPress theme | Adrena | Airsoft Club & Paintball WordPress Theme | <= 1.2.13 | no fix |
| WordPress theme | Advice - Psychology, Therapy & Counseling Theme | < 1.17.0 | 1.17.0 |
| WordPress theme | Agora — Event & Conference WordPress Theme | < 1.8.0 | 1.8.0 |
| WordPress theme | Alanzo | Chef & Event Catering WordPress Theme | <= 1.2.3 | 1.2.4 |
| WordPress theme | Albertino - Laboratory WordPress Theme | < 2.24.0.0 | 2.24.0.0 |
| WordPress theme | Alhambra | Mosque & Islamic WordPress Theme + RTL | <= 1.1.13 | no fix |
| WordPress theme | A.Williams | Assistant & Administrative Services WordPress Theme | <= 1.3.0 | 1.3.1 |
| WordPress theme | AlphaColor - Design & Printing Elementor Template Kit | <= 1.4.11.1 | no fix |
| WordPress theme | Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme | <= 1.2.1 | no fix |
| WordPress theme | Angela | Family Planning & Pregnancy Clinic WordPress Theme | <= 1.4.3 | no fix |
| WordPress theme | AI ANN - AI Generator & AI Agency WordPress Theme | < 1.33.0 | 1.33.0 |
| WordPress theme | Anubia | Smoking and Hookah Bar WordPress Theme | <= 1.0.14 | no fix |
| WordPress theme | Artesia - Freelancer WordPress Theme | < 1.20.0 | 1.20.0 |
| WordPress theme | Asclepius - Doctor & Medical Theme | < 1.25.0 | 1.25.0 |
| WordPress theme | Belicia - Luxury Resort & Hotel Theme | < 1.14.0 | 1.14.0 |
| WordPress theme | BeYoga | Yogastudio & Gym WordPress Theme | < 2.8.0 | 2.8.0 |
| WordPress theme | Birdily | Travel Agency & Tour Booking WordPress Theme | <= 1.2.3 | no fix |
| WordPress theme | Bonko | Safari & Zoo WordPress Theme | <= 1.0.14 | no fix |
| WordPress theme | Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL | < 2.22.0 | 2.22.0 |
| WordPress theme | Callie Britt | Family Counselling Psychology WordPress Theme | <= 1.2.3 | 1.2.3.1 |
| WordPress theme | Camelia | Floral Studio Florist WordPress Theme | <= 1.2.14 | 1.2.14.1 |
| WordPress theme | Carlax | Car Parts Store & Auto Service WordPress Theme | <= 1.1.1 | no fix |
| WordPress theme | Carz — Car Dealer, Shop & Repair WordPress Theme | < 1.6.0 | 1.6.0 |
| WordPress theme | ChainPress | Financial Business Blog PSD Template | <= 1.0.14 | no fix |
| WordPress theme | Chakra - Yoga Retreat & Leisure Center WordPress Theme | < 1.19.0 | 1.19.0 |
| WordPress theme | Chardonnay - Wine Store & Vineyard WordPress Theme | < 1.26.0 | 1.26.0 |
| WordPress theme | Childy — Kids Store & Baby Clothing WordPress Theme | < 1.11.0 | 1.11.0 |
| WordPress theme | Chrimson | Windows & Doors Installation Services Store WordPress Theme + AI | <= 2.2 | no fix |
| WordPress theme | City Hostel | Travel & Hotel Booking WordPress Theme | <= 1.2.3 | no fix |
| WordPress theme | 69 Clothing | Brand Store & Fashion Boutique WordPress Theme | <= 1.2.11 | 1.2.11.1 |
| WordPress theme | Corredo | Motorcycle & Bike Race Sports WordPress Theme | <= 1.1.14 | no fix |
| WordPress theme | Credit Card Experience | Loan Company and Online Banking WordPress Theme | <= 1.2.15 | no fix |
| WordPress theme | Crework | Coworking and Creative Space WordPress Theme | <= 1.1.11 | 1.1.12 |
| WordPress theme | Custom Made | Jewelry Manufacturer and Store WordPress Theme | <= 1.1.17 | no fix |
| WordPress theme | Def — CCTV & Bodyguard Security WordPress Theme | < 1.8.0 | 1.8.0 |
| WordPress theme | Drone Media | Aerial Photography & Videography Theme | < 2.8.0 | 2.8.0 |
| WordPress theme | Edema | Wellness & Spa WordPress Theme | < 1.2.2.1 | 1.2.2.1 |
| WordPress theme | Elementra - 100% Elementor WordPress Theme | <= 1.0.7 | 1.0.8 |
| WordPress theme | Fortunio - Carpenter, Forestry, Wood Manufacture Theme | < 2.12.0 | 2.12.0 |
| WordPress theme | Good Wine | Vineyard & Winery Shop WordPress Theme | <= 1.1.10 | no fix |
| WordPress theme | Gravity | Interior Design & Furniture Store WordPress Theme | <= 1.3.0 | no fix |
| WordPress theme | Gutentype | 100% Gutenberg Blog Theme + Elementor | <= 2.1.11 | 2.1.12 |
| WordPress theme | Hampton | Home Design and Renovation WordPress Theme | <= 1.3.3 | no fix |
| WordPress theme | Happy Rider - Horse School & Equestrian Center WordPress Theme | < 2.18.0 | 2.18.0 |
| WordPress theme | Healthy Blog - Blog WordPress Theme + Store | <= 1.2.8 | no fix |
| WordPress theme | Heaven11 | Property & Apartment Real Estate WordPress Theme | <= 1.0.9 | no fix |
| WordPress theme | Hello Summer | Children Camp WordPress Theme | <= 1.1.3 | no fix |
| WordPress theme | Hogwords | School, University Education WordPress Theme | <= 1.2.6 | no fix |
| WordPress theme | HotLock | Locksmith & Security Systems WordPress Theme + RTL | < 1.4.5 | 1.4.5 |
| WordPress theme | Inset - Digital Agency & IT Services WordPress Theme | < 1.21.0 | 1.21.0 |
| WordPress theme | Insurance Ancora - Finance WordPress Theme | < 2.16.0 | 2.16.0 |
| WordPress theme | Juno | Kids Toys & Games Store WordPress Theme | < 2.27.0 | 2.27.0 |
| WordPress theme | Kargo | Logistics & Transportation PSD Template | <= 1.1.13 | no fix |
| WordPress theme | Lab - Pharmacy, Laboratory & Research WordPress Theme | < 1.3.0 | 1.3.0 |
| WordPress theme | Laundry City | Dry Cleaning Services WordPress Theme | <= 1.2.17 | 1.2.18 |
| WordPress theme | MediaFlex - TV Channel & Streaming WordPress Theme | < 1.10.0 | 1.10.0 |
| WordPress theme | Nazareth | Church & Religion WordPress Theme | <= 1.0.16 | no fix |
| WordPress theme | OldStory - Whisky Bar | Pub | Restaurant Site Template | < 2.22.0 | 2.22.0 |
| WordPress theme | Partiso | Political Party & Candidate Elementor Template Kit | <= 1.1.12 | no fix |
| WordPress theme | PathWell | Senior Care WordPress Theme | <= 1.1.16 | 1.1.17 |
| WordPress theme | Planet Shakers | Church & Religion WordPress Theme | <= 1.0.7 | no fix |
| WordPress theme | Plastica - Plastic Surgery & Beauty WordPress Theme | < 1.12.0 | 1.12.0 |
| WordPress theme | Let's Play | Hockey School & Winter Sports WordPress Theme | <= 1.1.14 | no fix |
| WordPress theme | Podium | Fashion Model Agency WordPress Theme | <= 1.1.12 | no fix |
| WordPress theme | Preston | Fruit Company & Organic Farming WordPress Theme | <= 1.1.9 | no fix |
| WordPress theme | ProDent | Dental Clinic & Doctor WordPress Theme + Elementor + RTL | <= 1.5.9 | no fix |
| WordPress theme | ProGuards | Safety & Security Site Template | < 2.19.0 | 2.19.0 |
| WordPress theme | ProRange | Painting & Renovation Theme | < 2.12.0 | 2.12.0 |
| WordPress theme | Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT | < 3.6.0 | 3.6.0 |
| WordPress theme | Samadhi | Oriental Buddhist Temple WordPress Theme | <= 1.0.13 | no fix |
| WordPress theme | Smart Casa | Home Automation & House Technologies WordPress Theme | <= 1.0.11 | no fix |
| WordPress theme | SoccerClub - Football Team & Soccer League WordPress Theme | < 2.5.0 | 2.5.0 |
| WordPress theme | Softic - SaaS Software & Application WordPress Theme | < 1.17.0 | 1.17.0 |
| WordPress theme | Solio - Solar & Renewable Energy WordPress Theme | < 1.12.0 | 1.12.0 |
| WordPress theme | StevenWatkins - Personal Gym Trainer WordPress Theme | < 2.12.0 | 2.12.0 |
| WordPress theme | Stratego - Corporate Business & Consulting WordPress Theme | < 1.8.0 | 1.8.0 |
| WordPress theme | Studeon | Education Center & Training Courses WordPress Theme | <= 1.1.15 | no fix |
| WordPress theme | Tantra | Yoga Studio and Fitness Club WordPress Theme | < 2.9.0 | 2.9.0 |
| WordPress theme | Tax Help - Finance & Accounting Adviser Theme | < 2.23.0 | 2.23.0 |
| WordPress theme | Translang - Language Courses & Translation Services Elementor Template Kit | <= 1.1.16 | no fix |
| WordPress theme | Travesia | Travel Agency and Tour Booking WordPress Theme | <= 1.1.15 | no fix |
| WordPress theme | Vagabonds - Travel Blog Elementor Template Kit | <= 1.3.10 | no fix |
| WordPress theme | Wine House | Winery & Restaurant WordPress Theme | < 3.21.0 | 3.21.0 |
| WordPress theme | Wise Move | Relocation and Storage Services WordPress Theme | <= 1.1.15 | no fix |
| WordPress theme | WotaHub | Coworking Space WordPress Theme | <= 1.2.2 | no fix |
References
CVSS score
8.1/10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-98- Platform
- WordPress
- Package
Abogado - Lawyer WordPress Theme, Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor, Adrena | Airsoft Club & Paintball WordPress Theme- Disclosed
- 09.06.2025
- Updated
- 11.10.2026 10:23
Sources and licenses
Wordfence Intelligence - dc82bfca-75de-4c77-a0ac-b34525b29a8d - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Vulnerability history: Agora — Event & Conference WordPress Theme
All published vulnerabilities of this package (WordPress theme), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 06.2025 08.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2025: 1
- 2026: 1
-
Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.