CVE-2026-112850 in Your Dress Plugin
Summary
by MITRE • 10/23/2026
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as a PHP Remote File Inclusion (RFI) and Local File Inclusion (LFI) flaw within the AncoraThemes Your Dress plugin, specifically affecting versions up to 1.4.1, represents a critical security deficiency in how user-supplied input is handled during file inclusion operations. This type of vulnerability arises when an application fails to adequately validate or sanitize filenames before passing them to PHP functions such as include(), require(), include_once(), or require_once(). In the context of web applications built with PHP, these constructs are frequently used for modular code organization, allowing developers to embed external script files into a main page. However, if the filename parameter is derived directly from user input without rigorous checks against an allowlist of expected values, attackers can manipulate this input to point to maliciously crafted scripts hosted on remote servers or sensitive local system files.
From a technical perspective, the core issue lies in the lack of proper control over the file path used for inclusion. When a PHP script executes an include statement with unsanitized data, it essentially trusts that the provided string refers only to legitimate application resources. An attacker can exploit this by injecting absolute URLs pointing to external hosts containing malicious code, thereby triggering Remote File Inclusion. Alternatively, if the server configuration allows access to local filesystem paths and null bytes or directory traversal sequences are not properly filtered, an attacker might achieve Local File Inclusion, potentially reading sensitive files such as /etc/passwd on Linux systems or application configuration files that contain database credentials. This dual nature of the flaw means it can be leveraged for both remote code execution via RFI and information disclosure via LFI, depending on server configurations and available input vectors.
The operational impact of this vulnerability is severe, particularly because PHP Remote File Inclusion often leads to full system compromise. If an attacker successfully injects a malicious script through the include statement, that script executes with the same privileges as the web server process. This typically grants the attacker the ability to execute arbitrary commands on the underlying operating system, modify website content, deface pages, or install backdoors for persistent access. In cases where Local File Inclusion is exploited successfully, the immediate consequence is often unauthorized data exfiltration. Attackers can read sensitive configuration files, source code containing hardcoded secrets, or user database dumps, which facilitates further attacks such as credential stuffing or privilege escalation within the application environment.
This vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program and is closely related to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor when local files are accessed. In terms of offensive security frameworks, this flaw facilitates techniques categorized under ATT&CK T1505 Server Component Binary Injection or T1059 Command and Scripting Interpreter if remote code execution is achieved through RFI. The exploitation typically involves crafting HTTP requests that inject specific parameters into the vulnerable script's URL query string or POST data, directing the PHP interpreter to load external payloads rather than intended local files.
Mitigation strategies must focus on strict input validation and secure coding practices. Developers should avoid using dynamic filenames in include statements whenever possible. If dynamic inclusion is necessary, they must implement a whitelist approach where only predefined, expected file names are allowed for inclusion. Any user-supplied data used to construct file paths must be sanitized by stripping out directory traversal sequences such as ../ or ..\ and ensuring that the input does not contain URL schemes like http:// or ftp:// which could trigger remote inclusions. Additionally, server-side configurations should disable the allow_url_include directive in php.ini if remote file inclusion is not explicitly required for application functionality, thereby neutralizing the RFI vector entirely. Regular security audits and static code analysis tools can help identify such patterns early in the development lifecycle to prevent deployment of vulnerable versions like those found in Your Dress prior to version 1.4.2.