What is the CVSS score of CVE-2026-22324?

CVE-2026-22324 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-22324?

A high-severity vulnerability in the ThemeREX Melania WordPress theme could allow attackers to execute arbitrary code on affected websites, potentially compromising customer data, website integrity,…

How to fix or mitigate CVE-2026-22324?

Within 24 hours: Identify all WordPress installations using ThemeREX Melania theme version 2.5.0 or earlier and document affected systems. Within 7 days: Implement Web Application Firewall rules to block malicious file inclusion attempts, disable the theme if not critical to operations, or migrate to an alternative theme. Within 30 days: Establish a monitoring protocol for vendor patch releases and evaluate long-term theme replacement strategy.

PHP CVE-2026-22324

EUVD-2026-13659 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-20 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 20, 2026 - 09:45 euvd

EUVD-2026-13659

Analysis Generated

Mar 20, 2026 - 09:45 vuln.today

CVE Published

Mar 20, 2026 - 09:36 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through 2.5.0.

AnalysisAI

A PHP Local File Inclusion vulnerability exists in the ThemeREX Melania WordPress theme, allowing remote attackers to include and execute arbitrary local files on the server. All versions up to and including 2.5.0 are affected. The CVSS score of 8.1 indicates high severity with network-based attack vector, though attack complexity is rated as high; there is no evidence of active exploitation (not in KEV) or public proof-of-concept at this time.

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), a classic file inclusion weakness. The affected product is identified by CPE cpe:2.3:a:themerex:melania:*:*:*:*:*:*:*:*, specifically the Melania WordPress theme developed by ThemeREX. Despite the CVE description mentioning 'PHP Remote File Inclusion', the actual classification and tags confirm this as a Local File Inclusion (LFI) vulnerability. LFI occurs when user-supplied input is insufficiently sanitized before being passed to PHP file inclusion functions like include(), require(), or their variants, allowing attackers to traverse directories and include sensitive files such as /etc/passwd, WordPress configuration files containing database credentials, or log files that may contain PHP code injected through other means.

RemediationAI

Immediately upgrade the Melania theme to a version newer than 2.5.0 if available from ThemeREX. Contact the theme vendor directly through their support channels to obtain the patched version, as WordPress themes do not always auto-update. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/melania/vulnerability/wordpress-melania-theme-2-5-0-local-file-inclusion-vulnerability?_s_id=cve for specific remediation guidance and indicators of compromise. As an interim mitigation, implement Web Application Firewall (WAF) rules to detect and block directory traversal patterns in requests (e.g., sequences containing '../', '%2e%2e/', or null bytes). Restrict PHP's ability to include files outside the web root using open_basedir directives in php.ini. Review server logs for suspicious file inclusion attempts or unusual file access patterns. If the theme is not actively used, disable or remove it entirely from the WordPress installation.