WordPress Anona theme <= 8.0 - Arbitrary File Download vulnerability

The Arbitrary File Access vulnerability in Anona allows an attacker to bypass intended access restrictions and read arbitrary files on the server. This could expose sensitive data such as configuration files, database credentials, or even source code. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the entire server. The attacker could gain access to critical system information, leading to further attacks or data theft. This vulnerability is particularly concerning given the widespread use of WordPress and the potential for sensitive data to be stored within WordPress plugins.

WordPress sites using the Anona plugin, particularly those with default configurations or shared hosting environments, are at increased risk. Sites that haven't implemented robust file access controls or regularly scan for vulnerabilities are also more vulnerable.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/anona/*

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/anona/../../../../etc/passwd

• wordpress / composer / npm:

wp plugin list --status=inactive --all | grep anona

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2025-12-24
2. Veröffentlicht2026-01-22
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

Since a patched version of Anona is not yet available, immediate mitigation steps are crucial. The primary recommendation is to restrict file access permissions on the server to minimize the potential damage from a successful exploit. Implement strict access controls within the WordPress environment, limiting the ability of users to upload or modify files. Consider using a Web Application Firewall (WAF) to filter requests and block attempts to access files outside of the intended directories. Monitor server logs for suspicious file access attempts. After a patched version is released, upgrade Anona immediately. Verify the fix by attempting to access files outside the intended directories and confirming that access is denied.