Key points
- CVE-2026-112820 is rated CVSS 8.1 HIGH by the National Vulnerability Database.
- The flaw exists in Elated-Themes Academist Core versions up to and including 1.4.1.
- The vulnerability involves improper control of filenames for PHP include statements.
Small-business website owners using the Elated-Themes Academist Core must be aware of a serious security gap. The National Vulnerability Database lists CVE-2026-112820 as a high-severity issue. This flaw affects all versions of the theme up to 1.4.1. Attackers can exploit this weakness to perform PHP remote file inclusion. No official patch has been confirmed yet.
In plain English
The Academist Core theme contains a coding error that fails to properly check filenames. When the software tries to load a specific file, it does not verify if the request is safe. This allows an attacker to trick the system into loading other files from the server. This is known as a PHP local file inclusion vulnerability. It can lead to unauthorized access to sensitive data.
The background
This issue is classified under CWE-98, which covers improper control of filenames. The flaw has been present in the theme since its earlier releases. It remains unfixed in version 1.4.1, the latest version mentioned in the advisory. The National Vulnerability Database assigned a CVSS score of 8.1 to this specific weakness. This score indicates a high level of risk to affected systems.
What changes now
Businesses relying on this theme need to verify their current version immediately. If you are running any version up to 1.4.1, your site is potentially vulnerable. You should monitor for official announcements from Elated-Themes regarding a security update. Until a fix is released, the risk remains active. There is no confirmed workaround provided by the vendor at this time.
Who needs to act first
Web administrators should prioritize sites that are publicly accessible and accept user input. Teams usually begin by isolating critical systems to limit potential damage during an incident. It is essential to back up all site data before making any configuration changes. Check whether any third-party plugins interact directly with the theme's core files. Reduce exposure by restricting access to administrative interfaces where possible. Monitor server logs for unusual file access attempts that could indicate exploitation.
What to do and how to stay safe: Elated-Themes
- Verify the version of Elated-Themes Academist Core installed on your website.
- Monitor official channels from Elated-Themes for the release of a security patch.
- Restrict administrative access to trusted IP addresses to reduce attack surface.
- Enable detailed logging to detect any unauthorized file inclusion attempts.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a fix available for CVE-2026-112820?
No, the source material does not state that a patch or fix has been released yet.
Which versions of Academist Core are affected?
The vulnerability affects versions from n/a through 1.4.1.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-112820 as HIGH with a CVSS score of 8.1.
